{"id":"CVE-2026-106056","published":"2026-10-07T12:17:08.520","lastModified":"2026-10-07T17:16:47.057","description":"Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/rundeck/rundeck","tags":[]},{"url":"https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158","tags":[]},{"url":"https://github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013","tags":[]},{"url":"https://github.com/rundeck/rundeck/pull/10414","tags":[]},{"url":"https://github.com/rundeck/rundeck/releases/tag/v6.2.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/rundeck-before-6.2.0-os-command-injection-via-windows-job-option-quoting","tags":[]}],"exploitRefs":[{"url":"https://github.com/rundeck/rundeck","tags":[]},{"url":"https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158","tags":[]},{"url":"https://github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013","tags":[]},{"url":"https://github.com/rundeck/rundeck/pull/10414","tags":[]},{"url":"https://github.com/rundeck/rundeck/releases/tag/v6.2.0","tags":[]}],"hasPoc":true,"ai":{"summary":"Rundeck contains an OS command injection vulnerability in its Windows node executor that allows authenticated users to execute arbitrary commands with node executor credentials. This affects Windows nodes specifically and can lead to full system compromise.","exploitability":"Exploitation requires an authenticated user with job run permissions, but is relatively straightforward as attackers can inject cmd.exe metacharacters into free-text options that are improperly quoted.","blast_radius":"The vulnerability could impact all Windows nodes managed by Rundeck, potentially allowing attackers to execute commands with elevated privileges and access sensitive data across the entire Windows infrastructure.","remediation":"Upgrade to Rundeck 6.2.0 or later to remediate this OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","windows","os-command-execution"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:03:52.286Z"}}