What rundeck/rundeck shipped
Generated by FoxPlug from public activity — not affiliated with Rundeck.
Week of September 14, 2026
What shipped
- Security fix removes hardcoded default encryption password from RPM/DEB package installs. Pull request #10597
- Security fix stops caching plaintext LDAP passwords in heap memory. Pull request #10559
- Security fix upgrades reactor-core to address two Denial of Service vulnerabilities (CVE-2026-47857, CVE-2026-47863). Pull request #10606
- Security fix addresses path traversal vulnerability in Apache Ivy (CVE-2026-26032). Pull request #10595
- Bugfix restores job options and notifications when server-side validation fails during save. Pull request #10579
- Bugfix prevents 500 errors on Nodes page when a node source fails to load. Pull request #10592
- Bugfix restores rundeck-cli session authentication behind forwarded-headers proxies. Pull request #10596
- Bugfix strips trailing slash from job.serverUrl context variable to fix HTTP 400 errors. Pull request #10594
- Bugfix corrects osFamily detection for Ansible-discovered Windows nodes. Pull request #10607
- Bundled plugin versions updated to latest releases including ansible-plugin 5.1.3. Pull request #10616
Why it matters
This week addresses multiple security vulnerabilities in encryption, LDAP authentication, and dependencies that affect production deployments. Several regressions from recent releases are fixed, restoring functionality in proxy environments, job editing, and node discovery.
Changelog entry
- Security: Remove hardcoded default encryption password from RPM/DEB package installs (RUN-4532) Pull request #10597
- Security: Stop caching plaintext LDAP passwords in JettyCachingLdapLoginModule heap cache (RUN-4551) Pull request #10559
- Security: Upgrade reactor-core to 3.8.7 to fix CVE-2026-47857 and CVE-2026-47863 Pull request #10606
- Security: Upgrade Apache Ivy to fix CVE-2026-26032 path traversal vulnerability Pull request #10595
- Fix: Restore job options and notifications when server-side validation fails (RUN-4922) Pull request #10579
- Fix: Prevent 500 error on Nodes page when a node source fails to load (RUN-4952) Pull request #10592
- Fix: Restore rundeck-cli session authentication behind forwarded-headers proxies (RUN-4947) Pull request #10596
- Fix: Strip trailing slash from job.serverUrl context variable to prevent HTTP 400 errors (RUN-4919) Pull request #10594
- Fix: Correct osFamily detection for Ansible-discovered Windows nodes (RUN-4940) Pull request #10607
- Fix: Don't persist STATIC_TEXT plugin properties into saved job config (RUN-4866) Pull request #10539
- Fix: Keep AutogenInstanceId props out of STATIC_TEXT exclusion in pluginConfig (RUN-4866) Pull request #10619
- Fix: Correct newline trimming in storage config template (RUN-4971) Pull request #10590
- Fix: Log Output respects disabled Follow setting on large execution logs (RUN-4814) Pull request #10562
- Fix: rd system acls create no longer fails with JsonParseException (RUN-4790) Pull request #10537
- Fix: Error handler branch distinguished from main step in execution context (RUN-4837) Pull request #10582
- Fix: Explicitly request demographic/password attributes in LDAP findUser() (RUN-4860) Pull request #10532
- Fix: Add rundeck.metrics.legacy.enabled to Docker remco config template (RUN-4859) Pull request #10531
- Update: Bump bundled plugin versions to latest releases Pull request #10616
- Maintenance: Prettier config and prettier/prettier promoted to error in ui-trellis (RUN-4869) Pull request #10605
- Maintenance: Standardize TypeScript version across packages (RUN-4873) Pull request #10587
Week's highlights: security fixes for encryption defaults, LDAP password caching, and dependency CVEs. Bugfixes for job option persistence, node page errors, CLI auth behind proxies, and context variables.
This week's Rundeck updates focus on security and stability. We've addressed hardcoded encryption passwords in package installs, plaintext LDAP password caching, and dependency vulnerabilities. Several regressions are fixed: job options now persist when validation fails, the Nodes page handles failed sources gracefully, rundeck-cli works behind forwarded-headers proxies again, and context variables format correctly for API calls. Bundled plugins updated to latest releases.