Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92763Rundeck through 6.2.1 Authorization Bypass via Project Import
High 8.1
In plain English
A high-severity missing authorization in rundeck from rundeck. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 50.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Issue #10459 issue-tracking
- https://github.com/rundeck/rundeck product
- apiProjectImport guards importACL and importScm but not importConfig technical-description
- VulnCheck Advisory: Rundeck through 6.2.1 Authorization Bypass via Project Import third-party-advisory