Authorization Bypass in Rundeck Affects Project Import Configuration

CVE-2026-92763

What is CVE-2026-92763?

The Rundeck application prior to version 6.2.1 contains a security flaw where the importConfig and importNodesSources parameters are not properly authorized during the project archive import process. This design oversight permits attackers with minimal privileges, specifically those who possess the import action, to manipulate project configurations. Such actions can lead to alterations in critical security settings, including node executors and SSH key paths. Consequently, this vulnerability poses significant risks to job executions and overall system integrity.

References