CVE-2021-41112: 
Rundeck vulnerability analysis and mitigation

Rundeck, an open source automation service with a web console, command line tools and a WebAPI, was found to contain a security vulnerability in versions prior to 3.4.5. The vulnerability (CVE-2021-41112) allows authenticated users to modify or delete System or Project level Calendars without appropriate authorization (GitHub Advisory).

The vulnerability is classified as an improper authorization issue (CWE-862) where authenticated users could craft requests to modify or delete calendar configurations without having the appropriate permissions. This represents a security control bypass that could affect scheduled job executions (GitHub Advisory).

The impact of this vulnerability depends on the trust level of authenticated users and the criticality of scheduled jobs. Unauthorized modification or removal of calendars could cause scheduled jobs to execute at unintended times or fail to execute on desired calendar days, potentially disrupting automated workflows and system operations (GitHub Advisory).

The vulnerability has been patched in Rundeck version 3.4.5. Users are advised to upgrade to this version or later to address the security issue. No workarounds are available for this vulnerability (GitHub Advisory).