Authorization Bypass in Rundeck Project Archive Import

Rundeck versions 6.2.1 and earlier are vulnerable to an authorization bypass flaw (CVE-2026-92763) within the project archive import functionality. The vulnerability specifically affects the handling of the 'importConfig' and 'importNodesSources' parameters. An attacker holding only basic 'import' permissions - which are intended for managing project archives - can leverage these parameters to manipulate sensitive configuration files. By exploiting this flaw, an attacker can modify security-critical settings such as node executor definitions and SSH key paths. This manipulation allows for the redirection of job execution, potentially enabling the attacker to execute arbitrary code or commands in the context of the Rundeck service or target managed nodes. This flaw is particularly significant as it effectively escalates the privileges of an import-authorized user to those of a project administrator.

Impact

Successful exploitation allows a user with restricted import permissions to reconfigure project settings, leading to unauthorized code execution, credential exfiltration via modified SSH key paths, or full takeover of project-level automation tasks. This vulnerability affects all environments running Rundeck version 6.2.1 or older that utilize the project archive feature.

Recommendation

• Upgrade Rundeck to a patched version beyond 6.2.1 immediately to remediate CVE-2026-92763.
• Audit the access control policies to identify and restrict users assigned the 'import' permission until the patch is applied.
• Review Rundeck project configuration history and audit logs for unexpected modifications to 'project.properties' or node source configurations.