CVE-2026-105834: Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rundeckto a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A Rundeck user with only the project configure ACL can exploit it. No higher administrative privilege or user interaction is required.
What access does an attacker need to obtain sensitive files?
The attacker needs network access to Rundeck and project configure permission, then can set resources.source.N.config.file to an absolute server path. File contents can be retrieved through the editProjectNodeSourceFile or apiSourceGetContent endpoint.
What information could be exposed?
An attacker may read arbitrary files accessible to the Rundeck server process, including database passwords, LDAP bind credentials, and data belonging to other projects.
Which versions are affected?
Rundeck versions before 6.2.0 are affected. Upgrading to 6.2.0 or later addresses the issue.