CyberRota Analysis
AI-GeneratedRundeck versions up to 6.2.1 are vulnerable due to improper authorization in the project archive import endpoint, allowing attackers with import permissions to manipulate project configuration files. This can lead to unauthorized changes in critical settings, such as node executors and SSH key paths, potentially compromising job execution and security. Organizations utilizing Rundeck for project management should prioritize patching this vulnerability to safeguard their environments against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.