Rundeck EUVD-2026-94304

Requires an authenticated Rundeck account with job-run permission (PR:L) AND a job that executes against one or more Windows nodes using the cmd.exe-based Windows node executor, AND a job definition exposing a free-text/free-form option whose value is passed as a command argument. The attacker injects cmd.exe metacharacters (&&, |, >, ;) into that option; the flaw is that CLIUtils.quoteWindowsCMDArg wraps arguments in single quotes, which have no quoting semantics in cmd.exe and thus provide no injection protection. Commands run with the node executor's credential privileges. Limiting factors: exploitation is impossible without valid authentication and job-run authorization, requires Windows (not Unix) target nodes, and requires a reachable free-text option - deployments with only Unix nodes or fully constrained/enumerated option values are not affected.

This is a moderate-priority, authenticated RCE rather than a drive-by critical. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) and the computed 7.7 score are internally consistent with the description: exploitation is network-reachable through the Rundeck web/API layer but gated behind PR:L (a valid account holding job-run permission) and carries meaningful attack requirements (AT:P / AC:H) - specifically the presence of Windows target nodes and a free-text job option. Impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H) because successful injection yields arbitrary command execution with node-executor credential privileges. No EPSS score, KEV listing, or public exploit was provided in the intelligence, so there is NO signal of active or widespread exploitation; this appears to be a researcher-reported issue (VulnCheck) with a vendor patch already shipped, not an in-the-wild campaign. The GitHub PR diff independently confirms the root cause (CLIUtils.quoteWindowsCMDArg wrapping arguments in cmd.exe-ineffective single quotes), which raises confidence the flaw is real even absent a weaponized PoC. Net: treat as a prompt-patch item for Windows-node Rundeck deployments, but it is not a mass-exploitation emergency given the authentication and configuration prerequisites.

An authenticated Rundeck user holding job-run permission supplies a crafted free-text option value such as '80 && whoami' or '| net user' to a job that targets Windows nodes. Because quoteWindowsCMDArg wraps the value in single quotes - which cmd.exe treats as literal characters, not quoting - the injected && or | metacharacters are interpreted by the shell, executing attacker commands on the node with the node executor's credentials. No public exploit was identified, but the vendor PR diff and test cases confirm the metacharacter-injection mechanism.