Vulnerability Description
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/rundeck/rundeck
- https://github.com/rundeck/rundeck/blob/v5.20.1/rundeckapp/grails-app/controller
- https://github.com/rundeck/rundeck/issues/10459
- https://www.vulncheck.com/advisories/rundeck-through-6.2.1-authorization-bypass-
- https://github.com/rundeck/rundeck/issues/10459
FAQ
What is CVE-2026-92763?
CVE-2026-92763 is a vulnerability with a CVSS score of 8.1 (HIGH). Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project c...
How severe is CVE-2026-92763?
CVE-2026-92763 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92763?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.