CVE-2021-41111 - CVE House
Back to Database
Status published Medium CVE-2021-41111

Authorization Bypass Through User-Controlled Key in Rundeck

Vulnerability Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41111

Credits & Attribution

No credits recorded in the NVD database.

References

More from rundeck

View All →
CVE-2023-48222
Authenticated users can view or delete jobs they do not have authorization for in Rundeck
High 8.1
CVE-2023-47112
Authenticated users can view job names and groups they do not have authorization to view in Rundeck
Medium 4.3
CVE-2022-31044
Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
High 7.5
CVE-2022-29186
Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
Critical 9.1
CVE-2021-41112
Missing Authorization in Rundeck
High 8.1

Affected Vendor

Affected Software

rundeck
Vulnerable Versions:
< 3.3.15, >= 3.4.0, < 3.4.5

Timeline

Official Publish: February 28th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-639

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation