CVE-2026-106056: Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Rundeck deployments before 6.2.0 are affected when jobs run on Windows nodes and accept attacker-controlled values through free-text job options. The injected commands execute with the credentials used by the node executor.
What access does an attacker need?
An attacker must be authenticated and have permission to run a vulnerable job. They do not need user interaction, but must be able to supply crafted values for free-text options.
Are all job options affected?
The described injection path involves free-text options whose values reach Windows command execution. Crafted cmd.exe metacharacters, including && and |, can bypass the ineffective single-quote handling.
What version resolves the issue?
Upgrade Rundeck to version 6.2.0 or later. The issue affects versions before 6.2.0.