CVE-2026-106056CWE-78command-injection

CVE-2026-106056

High · published October 7, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
68.4
In the wild
Unconfirmed
What it is

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01216 · 68.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-07T16:17Z
References (6)
https://github.com/rundeck/rundeck · [email protected]https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158 · [email protected]https://github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013 · [email protected]https://github.com/rundeck/rundeck/pull/10414 · [email protected]https://github.com/rundeck/rundeck/releases/tag/v6.2.0 · [email protected]https://www.vulncheck.com/advisories/rundeck-before-6.2.0-os-command-injection-via-windows-job-option-quoting · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 1%
    epss
  • 07 OCT 11:59Z
    Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
    cvelistv5