CVE-2026-106056

Summary

Rundeck contains an OS command injection vulnerability in its Windows node executor that allows authenticated users to execute arbitrary commands with node executor credentials. This affects Windows nodes specifically and can lead to full system compromise.

Exploitability

Exploitation requires an authenticated user with job run permissions, but is relatively straightforward as attackers can inject cmd.exe metacharacters into free-text options that are improperly quoted.

Blast radius

The vulnerability could impact all Windows nodes managed by Rundeck, potentially allowing attackers to execute commands with elevated privileges and access sensitive data across the entire Windows infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Rundeck 6.2.0 or later to remediate this OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.