CVE-2026-106056

HIGH 7.5

Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.

CWE	CWE-78
Vendor	rundeck
Product	rundeck
Published	Oct 7, 2026

Stay Ahead of the Next One

Get instant alerts for rundeck rundeck

Be the first to know when new high vulnerabilities affecting rundeck rundeck are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

rundeck / rundeck

0 < 6.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rundeck/rundeck/pull/10414 github.com: https://github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013 github.com: https://github.com/rundeck/rundeck github.com: https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158 github.com: https://github.com/rundeck/rundeck/releases/tag/v6.2.0 vulncheck.com: https://www.vulncheck.com/advisories/rundeck-before-6.2.0-os-command-injection-via-windows-job-option-quoting

Credits

Eldor Nabijonov