CVE-2022-31044: Rundeck Key Storage Encryption Bypass
Summary
CVE-2022-31044: Rundeck's Key Storage converter plugin mechanism's encryption layer not working in 4.2.0, 4.2.1, 4.3.0. Affects org.rundeck:rundeck across 2 version ranges.
>= 4.2.0, < 4.2.2
>= 4.3.0, < 4.3.1
Fixed in 4.2.2 or 4.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rundeck is an open-source automation tool that helps with job scheduling and execution across various systems. It provides a user-friendly interface for managing workflows and orchestrating tasks. One of its features is the Key Storage converter plugin mechanism, which allows users to encrypt and store sensitive credentials securely. However, versions 4.2.0, 4.2.1, and 4.3.0 of Rundeck had a flaw in the encryption layer of the Key Storage converter plugin, leading to the possibility of plaintext credentials being written to the backend storage. This vulnerability affects users who have configured a Storage Converter plugin, such as 'jasypt-encryption', and installed the vulnerable versions of Rundeck.
Vulnerability Detail
The Key Storage converter plugin mechanism in Rundeck 4.2.0, 4.2.1, and 4.3.0 was not enabled correctly, resulting in the encryption layer not functioning as intended. This means that any credentials created or overwritten during this period might have been stored in plaintext format in the backend storage. This poses a significant security risk as sensitive information can be easily accessed by unauthorized individuals. It is important to note that if a user does not use a Storage Converter plugin, they are not affected by this vulnerability.
How To Fix
Latest published version: 6.0.1-20260715 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.24.2.2 -
>= 4.3.0, < 4.3.14.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrade is not feasible, a temporary workaround is to disable write access to the key storage via Access Control Lists (ACLs). This can be achieved by implementing the following ACL policy:
by: group: '.*' context: application: rundeck for: storage:
- deny:
- create
- update description: deny create or update for storage in application context
by: group: '.' context: project: . for: storage:
- deny:
- create
- update description: deny create or update for storage in project context
This policy will prevent any new credentials from being written to the storage. Once the upgrade to a patched version is completed, write access can be restored.
Conclusion
The Rundeck Key Storage Encryption Bypass vulnerability in versions 4.2.0, 4.2.1, and 4.3.0 can lead to plaintext credentials being stored in the backend storage. It is crucial to upgrade to the patched versions or apply the provided workaround to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.rundeck:rundeck →
FAQ
The impact of this vulnerability is that credentials stored using Rundeck 4.2.0, 4.2.1, or 4.3.0 might have been saved in plaintext format, making them easily accessible to unauthorized individuals.
Users who have installed Rundeck 4.2.0, 4.2.1, or 4.3.0 and have configured a Storage Converter plugin, such as 'jasypt-encryption', are affected by this vulnerability. Users who do not use a Storage Converter plugin are not impacted.
If you are using the 'jasypt-encryption' plugin, encrypted values will have a metadata field of 'jasypt-encryption:encrypted:true' in the JSON metadata. You can query your key storage backend to identify keys that are unencrypted. For example, in MySQL, you can use the following query:
select id, dir, name from storage where json_data not like '%jasypt-encryption:encrypted:"true"%' and namespace is null and dir like 'keys%'
Upgrading to Rundeck 4.3.2 or 4.2.3 will fix the code and re-encrypt any plaintext values. Alternatively, upgrading to Rundeck 4.4.0 or later releases will also include the necessary fix.
If immediate upgrade is not feasible, you can temporarily disable write access to the key storage via Access Control Lists (ACLs). The provided ACL policy in the 'workaround' section can be used to deny create and update operations for storage in both application and project contexts.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.rundeck:rundeck.
