Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

GHSA-3jmw-c69h-426c · CVE-2021-39133

Published Sep 1, 2021 · Modified Jul 8, 2026

Description

Impact

A user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

Patches

Available in Rundeck 3.4.3 and 3.3.14

Workarounds

Please visit https://rundeck.com/security for information about specific workarounds.

For more information

If you have any questions or comments about this advisory:

Email us at security@rundeck.com

To report security issues to Rundeck please use the form at https://rundeck.com/security

References

WEB https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-39133
WEB https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9
PACKAGE https://github.com/rundeck/rundeck

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes