Path Traversal Vulnerability in Rundeck Affects File Access

CVE-2026-105834

What is CVE-2026-105834?

Rundeck prior to version 6.2.0 is susceptible to a path traversal vulnerability that enables users with only project-level configure permissions to access sensitive files across the server. By manipulating the resources.source.N.config.file to point to any absolute path, attackers can exploit the editProjectNodeSourceFile or apiSourceGetContent functionality. This exposure may lead to unauthorized retrieval of database credentials, LDAP bind information, and other critical project data.

References