CVE-2026-92763

8.1 Élevée

Publiée le 16/09/2026 à 23:17 · Modifiée le 24/09/2026 à 22:47 · En attente d'analyse NVD · Source : disclosure@vulncheck.com

Description

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.

Traduire en français

Produits concernés

rundeck

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.6 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	8.1 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/rundeck/rundeck
https://github.com/rundeck/rundeck/blob/v5.20.1/rundeckapp/grails-app/controllers/rundeck/controllers/ProjectController.groovy#L3395-L3506
https://github.com/rundeck/rundeck/issues/10459
https://www.vulncheck.com/advisories/rundeck-through-6.2.1-authorization-bypass-via-project-import
https://github.com/rundeck/rundeck/issues/10459

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories