CVE-2026-106056: Rundeck OS Command Injection RCE Vulnerability

CVE-2026-106056 Overview

CVE-2026-106056 is an OS command injection vulnerability [CWE-78] in Rundeck versions before 6.2.0. Authenticated users with job run permission can execute arbitrary commands on Windows nodes by supplying crafted option values. The flaw resides in the CLIUtils.quoteWindowsCMDArg function, which wraps user input in single quotes that cmd.exe does not treat as string delimiters. Attackers inject cmd.exe metacharacters such as && or | into free-text job options to break out of the intended argument and run commands with the node executor's credential privileges.

Critical Impact

Authenticated attackers can execute arbitrary OS commands on managed Windows nodes with the privileges of the configured node executor, enabling lateral movement across the orchestrated fleet.

Affected Products

• Rundeck versions prior to 6.2.0
• Rundeck deployments executing jobs against Windows node targets
• Any Rundeck instance using CLIUtils.quoteWindowsCMDArg for argument quoting

Discovery Timeline

• 2026-10-07 - CVE CVE-2026-106056 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106056

Vulnerability Analysis

Rundeck orchestrates job execution across remote nodes, including Windows targets reached through node executors. When a job defines free-text options, Rundeck substitutes user-supplied values into the command line sent to the Windows node. The quoting routine CLIUtils.quoteWindowsCMDArg encloses argument values in single quotes before passing them to cmd.exe.

The Windows command interpreter does not recognize single quotes as string delimiters. As a result, metacharacters embedded inside the single-quoted value remain active. An attacker who supplies an option value containing &&, |, &, or || terminates the intended argument boundary and chains additional commands onto the executed line.

Exploitation requires an authenticated account with permission to run a job that references a user-controlled option. The injected commands execute under the identity used by the Rundeck node executor, which commonly holds administrative or service-account privileges on target Windows systems.

Root Cause

The root cause is incorrect argument escaping for the Windows cmd.exe interpreter inside CLIUtils.quoteWindowsCMDArg. The function treats single quotes as effective quoting characters, but cmd.exe only honors double quotes with its own escaping conventions. Shell metacharacters inside the single-quoted span are never neutralized, so option values flow directly into the command parser.

Attack Vector

An authenticated user with job run rights supplies a crafted value for a free-text option. For example, a payload resembling value && whoami > C:\\temp\\pwn.txt breaks out of the ineffective single-quote wrapping and appends attacker-controlled commands. The commands execute on each targeted Windows node with the privileges configured for the node executor. See the VulnCheck Advisory for Rundeck and the vulnerable CLIUtils code snippet for technical details.

Detection Methods for CVE-2026-106056

Indicators of Compromise

• Rundeck job execution logs containing option values with &&, ||, |, or & metacharacters embedded in free-text fields.
• Unexpected child processes spawned by the Rundeck node executor service on Windows targets, especially cmd.exe, powershell.exe, net.exe, or whoami.exe.
• New files, scheduled tasks, or local accounts created on Windows nodes shortly after a job execution event.

Detection Strategies

• Audit Rundeck job definitions and execution history for free-text options receiving values containing shell metacharacters.
• Correlate Rundeck job start timestamps with Windows Security Event ID 4688 (process creation) on target nodes to identify unexpected process trees.
• Baseline normal child-process behavior of the Rundeck node executor account and alert on deviations such as reconnaissance utilities or script interpreters.

Monitoring Recommendations

• Forward Rundeck application and audit logs along with Windows Sysmon and Security logs to a centralized analytics platform for correlation.
• Alert on job runs executed by low-privilege Rundeck users that target production Windows nodes with free-text option values.
• Monitor the service account used by node executors for anomalous authentication and command execution patterns across the fleet.

How to Mitigate CVE-2026-106056

Immediate Actions Required

• Upgrade Rundeck to version 6.2.0 or later, which contains the fix delivered in Rundeck commit 807d9cf and Pull Request #10414.
• Review all job definitions that use free-text options and restrict execute permissions to trusted operators until patching completes.
• Rotate credentials used by Windows node executors if evidence suggests prior exploitation.

Patch Information

The vulnerability is remediated in Rundeck Release v6.2.0. The fix corrects the Windows argument quoting logic in CLIUtils.quoteWindowsCMDArg so that cmd.exe metacharacters supplied in option values no longer break out of the intended argument boundary. Administrators should validate their deployment version through the Rundeck administration console after upgrading.

Workarounds

• Replace free-text job options with allowed-values enumerations or regex-validated inputs that reject shell metacharacters such as &, |, <, >, and ^.
• Restrict run and runAs ACL policies so that only vetted users can execute jobs targeting Windows nodes.
• Configure node executors to use the lowest-privileged Windows service account that still satisfies operational requirements, limiting the blast radius of a successful injection.

# Example ACL policy snippet restricting job run on Windows nodes
description: Restrict Windows job execution
context:
  project: '.*'
for:
  job:
    - allow: [read]
      deny: [run, run_as_user]
by:
  group: [untrusted_operators]