CVE-2026-106056

Published 7 October 2026 · tracked since 8 October 2026

Description

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quot

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-107204 CRITICAL 9.8
• CVE-2026-106559 MEDIUM 6.3
• CVE-2026-106560 HIGH 7.1
• CVE-2026-106561 MEDIUM 5
• CVE-2026-106563 MEDIUM 5.3
• CVE-2026-106558 HIGH 8.8
• CVE-2026-106510 HIGH 7.7
• CVE-2026-106556 HIGH 7.7
• CVE-2025-70521 CRITICAL 9.8
• CVE-2025-70518 CRITICAL 10

→ Open the live CVE board · all tools