https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T11:11:55.623107+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-70091 cnvd-2021-70091 2026-10-07T11:11:55.626542+00:00 cnvd-2021-70091 https://cve.radiocsirt.org/vuln/euvd-2026-30432 EUVD-2026-30432 2026-10-07T11:11:55.626582+00:00 EUVD-2026-30432 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39132 fkie_cve-2021-39132 2026-10-07T11:11:55.626597+00:00

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14

 https://cve.radiocsirt.org/vuln/ghsa-q4rf-3fhx-88pf GHSA-q4rf-3fhx-88pf — YAML deserialization can run untrusted code 2026-10-07T11:11:55.626634+00:00

Affected: Maven: org.rundeck:rundeck-core

### Impact

An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition.

The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:

* `admin` level access to the `system` resource type

The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions:

* `create` `update` or `admin` level access to a `project_acl` resource * `create` `update` or `admin` level access to the `system_acl` resource

The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only.

### Patches Versions 3.4.3, 3.3.14

### Workarounds

Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.

### For more information If you have any questions or comments about this advisory: * Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)

Reporter: Rojan Rijal from Tinder Red Te…

 https://cve.radiocsirt.org/vuln/gsd-2021-39132 gsd-2021-39132 2026-10-07T11:11:55.626681+00:00 gsd-2021-39132