CVE-2020-11009

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher. This vulnerability is patched in version 3.2.6

• CWE-200
• CWE-639

• https://docs.rundeck.com/docs/history/3_2_x/version-3.2.6.htmlRelease Notes, Vendor Advisory
• https://github.com/rundeck/rundeck/security/advisories/GHSA-5679-7qrc-5m7jThird Party Advisory
• https://docs.rundeck.com/docs/history/3_2_x/version-3.2.6.htmlRelease Notes, Vendor Advisory
• https://github.com/rundeck/rundeck/security/advisories/GHSA-5679-7qrc-5m7jThird Party Advisory

Published

Apr 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11003Oasis before version 2.15.0 has a potential DNS rebinding or…8.1
• CVE-2020-11004SQL Injection was discovered in Admidio before version 3.3.1…7.5
• CVE-2020-11005The WindowsHello open source library (NuGet HaemmerElectroni…5.5
• CVE-2020-11006In Shopizer before version 2.11.0, a script can be injected …5.4
• CVE-2020-11007In Shopizer before version 2.11.0, using API or Controller b…6.5
• CVE-2020-11008Affected versions of Git have a vulnerability whereby Git ca…7.5
• CVE-2020-1101A cross-site-scripting (XSS) vulnerability exists when Micro…5.4
• CVE-2020-11010In Tortoise ORM before versions 0.15.23 and 0.16.6, various …8.8
• CVE-2020-11011In Phproject before version 1.7.8, there's a vulnerability w…8.8
• CVE-2020-11012MinIO versions before RELEASE.2020-04-23T00-58-49Z have an a…7.5
• CVE-2020-11013Their is an information disclosure vulnerability in Helm fro…5
• CVE-2020-11014Electron-Cash-SLP before version 3.6.2 has a vulnerability. …8.6