CVE-2026-92763: Rundeck Authorization Bypass Vulnerability

CVE-2026-92763 Overview

CVE-2026-92763 is an authorization bypass vulnerability in Rundeck through version 6.2.1. The flaw resides in the project archive import endpoint, which fails to properly authorize the importConfig and importNodesSources parameters. Attackers holding only the import action permission can replace project configuration files, including security-relevant settings such as node executors and SSH key paths that influence job execution. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
An authenticated attacker with limited import privileges can overwrite project configuration and manipulate job execution context, enabling privilege escalation and potential command execution on Rundeck-managed nodes.

Affected Products

Rundeck versions through 6.2.1
Rundeck Community Edition
Rundeck Enterprise deployments running affected versions

Discovery Timeline

2026-09-16 - CVE-2026-92763 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92763

Vulnerability Analysis

Rundeck exposes a project archive import endpoint that accepts a zip bundle containing project data, configuration, and node source definitions. The endpoint checks that the calling user has the import action on the target project, but it does not enforce additional authorization on two request parameters: importConfig and importNodesSources. When these parameters are set, the import handler applies the supplied configuration and node source definitions directly to the project.

Because administrative actions such as configure and admin normally guard project configuration changes, the missing check on the import path lets a low-privileged user modify settings that should require elevated permissions. Affected settings include node executor definitions and SSH key storage paths, both of which determine how Rundeck jobs authenticate to and execute commands on remote nodes.

Root Cause

The root cause is a missing authorization check in the ProjectController import logic. The controller validates the import action but does not re-check configure or admin when importConfig or importNodesSources are present in the request. The affected code path is visible in the Rundeck ProjectController source.

Attack Vector

An authenticated attacker sends a crafted project archive to the import endpoint with importConfig=true and importNodesSources=true. The archive contains modified project.properties and node source XML files that redirect job execution through an attacker-controlled node executor or point SSH key references to a storage path the attacker can influence. Subsequent job runs execute using the substituted configuration, giving the attacker a path to arbitrary command execution on managed nodes or exposure of key material tied to higher-privileged accounts. Additional detail is available in the VulnCheck advisory and Rundeck Issue #10459.

Detection Methods for CVE-2026-92763

Indicators of Compromise

POST requests to the project import endpoint (/api/*/project/*/import) containing importConfig=true or importNodesSources=true from accounts that do not routinely perform administrative actions.
Unexpected modifications to project.properties, node source definitions, or resources.xml files on the Rundeck server filesystem.
New or altered node executor plugin references pointing to unfamiliar scripts, binaries, or SSH key storage paths.

Detection Strategies

Audit Rundeck application logs for import events and correlate the acting user against the ACL policy assigned for the target project.
Alert on any import operation where the request initiator lacks the configure or admin action but the resulting project configuration changed.
Baseline expected node executor and SSH key path values per project, then flag deviations as suspicious drift.

Monitoring Recommendations

Forward Rundeck audit logs and web server access logs to a centralized analytics platform for retention and query.
Monitor job execution history for jobs whose executor or credential reference changed shortly after an import event.
Track outbound connections from Rundeck-managed nodes for anomalous destinations following configuration changes.

How to Mitigate CVE-2026-92763

Immediate Actions Required

Restrict the import action in Rundeck ACL policies to trusted administrators until a patched release is deployed.
Review all recent project imports and validate that current project.properties, node executor, and SSH key configurations match approved baselines.
Rotate SSH keys and node credentials referenced by any project that received an unexpected import.

Patch Information

At the time of publication, remediation guidance is tracked in Rundeck Issue #10459 and the VulnCheck advisory. Upgrade to a Rundeck release later than 6.2.1 that includes an authorization check on the importConfig and importNodesSources parameters. Consult the Rundeck GitHub repository release notes for the specific fixed version applicable to your deployment channel.

Workarounds

Remove the import action from role definitions that do not also carry configure and admin for the affected projects.
Place Rundeck behind a reverse proxy that blocks requests to the project import endpoint from non-administrative source networks.
Enforce file integrity monitoring on the Rundeck project storage directory to detect unauthorized configuration changes.

bash

# Example Rundeck ACL policy fragment restricting import to administrators
description: Restrict project import to admins only
context:
  project: '.*'
for:
  project:
    - allow: [read]
    - deny:  [import]
by:
  group: [developers, operators]
---
description: Allow full project management for admins
context:
  project: '.*'
for:
  project:
    - allow: [read, import, configure, admin]
by:
  group: [admin]