CVE-2026-105834: Rundeck Path Traversal Vulnerability

CVE-2026-105834 Overview

CVE-2026-105834 is a path traversal vulnerability [CWE-22] in Rundeck before version 6.2.0. The flaw allows authenticated users holding only the project configure Access Control List (ACL) permission to read arbitrary files from the Rundeck server. Attackers set resources.source.N.config.file to any absolute path and retrieve contents through the editProjectNodeSourceFile controller action or the apiSourceGetContent API endpoint. Exploitation exposes database passwords, Lightweight Directory Access Protocol (LDAP) bind credentials, and configuration data belonging to other Rundeck projects. The vulnerability was addressed in the Rundeck v6.2.0 release.

Critical Impact
Low-privileged project configurators can read any file readable by the Rundeck process, including credential stores and cross-project secrets.

Affected Products

Rundeck versions prior to 6.2.0
Rundeck FileResourceModelSource component
Rundeck project configuration API (apiSourceGetContent)

Discovery Timeline

2026-10-06 - CVE-2026-105834 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105834

Vulnerability Analysis

Rundeck resolves node source configurations through the FileResourceModelSource class. When a project administrator edits a node source, the backend accepts a config.file property that points to the resource definition file on disk. Prior to version 6.2.0, Rundeck did not validate whether the supplied path resided within the authorized project directory. A user holding the configure ACL on any single project could therefore reference absolute paths such as /etc/rundeck/rundeck-config.properties or /var/lib/rundeck/projects/<other-project>/etc/project.properties.

The apiSourceGetContent endpoint and the editProjectNodeSourceFile controller action then returned the raw file contents to the caller. This converts a project-scoped configuration permission into server-wide file disclosure. Credentials for backend databases, LDAP bind accounts, cloud provider keys, and secrets held in sibling projects become reachable through standard API calls.

Root Cause

The root cause is missing path canonicalization and authorization checks in the resource model source loader. The code trusted the operator-supplied file configuration value and passed it directly to Java file input/output (I/O) routines without constraining the path to the project directory.

Attack Vector

An authenticated user with the project configure ACL submits a modified node source configuration setting resources.source.N.config.file to an absolute server path. The attacker then issues a GET request to the apiSourceGetContent endpoint for the mutated source index. Rundeck reads the referenced file and returns its contents in the HTTP response body.

java

// Patch excerpt - WriteableModelSource.java
package com.dtolabs.rundeck.core.resources;

import com.dtolabs.rundeck.core.common.Framework;
import com.dtolabs.rundeck.core.plugins.configuration.ConfigurationException;

import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.util.Map;

/**
 * A ResourceModelSource that can write formatted model data
 */

Source: Rundeck Commit a462982. The patch introduces ConfigurationException and Framework imports so the writeable source can validate requested paths against the project context before performing I/O.

Detection Methods for CVE-2026-105834

Indicators of Compromise

Requests to apiSourceGetContent or editProjectNodeSourceFile where the returned file path lies outside /var/lib/rundeck/projects/<project>/etc/.
Project configuration edits that set resources.source.N.config.file to an absolute path pointing at /etc/, /root/, or another project's directory.
Audit log entries showing configure ACL users modifying node sources immediately followed by API fetches of source content.

Detection Strategies

Parse Rundeck audit logs for project.configure actions that change resources.source.*.config.file values to paths beginning with /.
Alert on HTTP access logs when apiSourceGetContent responses exceed the typical size of a project resource file.
Correlate node source edits with subsequent reads of sensitive files such as rundeck-config.properties, realm.properties, or jaas-loginmodule.conf.

Monitoring Recommendations

Forward Rundeck application and audit logs to a centralized Security Information and Event Management (SIEM) platform for retention and correlation.
Baseline the set of file paths referenced by legitimate node source definitions and flag deviations.
Review which accounts hold the configure ACL and monitor their API usage for anomalies.

How to Mitigate CVE-2026-105834

Immediate Actions Required

Upgrade Rundeck to version 6.2.0 or later on all server instances.
Rotate database passwords, LDAP bind credentials, and any secrets stored in files readable by the Rundeck process account.
Audit project ACL policies and remove the configure permission from users who do not require it.
Review historical audit logs for suspicious edits to resources.source.N.config.file values.

Patch Information

The fix shipped in the Rundeck v6.2.0 Release via Pull Request #10437. Core changes land in commits 5ec3d0a and a462982, which add path and content validation to the apiSourceGetContent API endpoint and the WriteableModelSource class. See the VulnCheck Advisory for Rundeck for additional analysis.

Workarounds

Restrict the project configure ACL to a small number of trusted administrators until the patch is applied.
Run the Rundeck service account under a dedicated Unix user with filesystem permissions limited to the Rundeck installation and project directories.
Store secrets in the Rundeck Key Storage facility or an external vault rather than on the filesystem readable by the Rundeck process.

bash

# Verify installed Rundeck version and upgrade on Debian/Ubuntu
dpkg -l | grep rundeck
sudo apt-get update && sudo apt-get install --only-upgrade rundeck=6.2.0-1
sudo systemctl restart rundeckd