CVE-2021-41112 - CVE House
Back to Database
Status published High CVE-2021-41112

Missing Authorization in Rundeck

Vulnerability Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41112

Credits & Attribution

No credits recorded in the NVD database.

References

More from rundeck

View All →
CVE-2023-48222
Authenticated users can view or delete jobs they do not have authorization for in Rundeck
High 8.1
CVE-2023-47112
Authenticated users can view job names and groups they do not have authorization to view in Rundeck
Medium 4.3
CVE-2022-31044
Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
High 7.5
CVE-2022-29186
Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
Critical 9.1
CVE-2021-41111
Authorization Bypass Through User-Controlled Key in Rundeck
Medium 6.4

Affected Vendor

Affected Software

rundeck
Vulnerable Versions:
< 3.4.5

Timeline

Official Publish: February 28th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact