CVE-2021-39133: Pagerduty Rundeck

Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.

Affected products

• Pagerduty Rundeck: before 3.3.14 (fixed in 3.3.14); from 3.4.0, before 3.4.3 (fixed in 3.4.3)

Published 2021-08-30. Last modified 2026-06-17.