Auth bypass in Rundeck
CVE-2026-92763
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-92763?
- CVE-2026-92763 is a high-severity vulnerability in Rundeck, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-09-16.
- How severe is CVE-2026-92763?
- High severity. CVSS v3 base score is 8.1 out of 10.