# Security Advisories

April 4th, 2022

The Rundeck / Process Automation team has released a hotfix version 4.0.1 to address the vulnerabilities in Spring Framework announced here (opens new window).

All future releases will also include this fix.

Download the latest version here (opens new window).

# Past Rundeck CVEs

These are the Security Advisories Rundeck has issued in the past. It is always recommended to upgrade to the current version of Rundeck (4.6.1) for the latest security updates.

  • CVE-2022-29186
    Key Pair Misconfiguration may expose systems.
  • CVE-2021-41112
    Authenticated users can modify Calendars without appropriate authorization.
  • CVE-2021-41111
    Webhook data and tokens can be revealed to an unauthorized user.
  • CVE-2021-39133
    Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server.
  • CVE-2021-39132
    YAML deserialization can run untrusted code.
  • CVE-2020-11009
    IDOR can reveal execution data and logs to unauthorized user.

For information about Log4j / Log4Shell please see this page.