CVE-2026-106056

Rundeck versions before 6.2.0 are vulnerable to an OS command injection vulnerability. The flaw exists because the CLIUtils.quoteWindowsCMDArg method wraps free-text options in ineffective single quotes, allowing authenticated users with job run permissions to inject cmd.exe metacharacters like &...

CVE-2026-106056 Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...