Rundeck on 4,729 hosts: a job scheduler that holds the credentials to run them

Rundeck is a job scheduler and runbook automation platform. Teams use it to turn operational procedures into jobs that can be triggered by a person or a schedule, which means the platform stores the keys it needs to reach the systems those jobs act on. A ZoomEye title query returns 4,729 matches.

Context and method

The figure comes from the condition title="Rundeck", executed with sub_type=all and a page size of one. The page size caps the records returned in a single response and has no effect on the matched total, which is the number reported for the condition.

A title match describes hosts that presented the string at index time. It does not confirm that a host is reachable now, and it does not reveal which jobs or credentials are configured.

The shape of the asset

Automation platforms occupy a specific and uncomfortable position. They exist because operators should not log in to servers by hand, so they are granted the access that operators would otherwise use. A single Rundeck instance therefore accumulates SSH keys, API tokens and cloud credentials for the systems it manages, and it stores them in a keystore that the application can read at run time.

It also holds the job definitions themselves. Those definitions are a description of the environment: which hosts run which service, what the deployment order is, which command restarts a component, and where the backups go. For an attacker, the definitions are a map, and the credentials are the keys.

Rundeck's history includes security fixes in its release notes, as with most platforms of its age, and a self-hosted instance that has not been updated carries whatever those fixes addressed. The plugin model adds a second surface, because plugins are often installed from third parties and may not receive the same attention as the core application.

Why the counts are modest and the stakes are not

A count in the low thousands is normal for a self-managed automation platform. These deployments are deliberate: someone decided to standardise operations and installed the tool to do it. That decision usually comes with an inventory entry and a change record, which is an advantage for defenders.

The disadvantage is what the platform can do. An instance that can restart a service across a fleet can also stop it. An instance with credentials for a database can query it. The blast radius of a compromise is the set of jobs configured on the instance, and that set grows over time as more procedures are automated.

What to verify

Four checks cover the usual gaps. Whether the web interface is reachable from outside the network that operations uses, since the login page is the front door to every stored credential. Whether local accounts exist alongside the organisation's single sign-on, because a local break-glass account is a second path that may not be audited. Which project-level access controls are configured, since Rundeck supports per-project authorisation and many deployments leave the default broad. And whether the job log retention is appropriate, because the logs record the output of every executed job and often contain more than intended.

A fifth item concerns the outbound path. An automation platform initiates connections to many hosts, and the network controls around it are frequently written to allow everything, because restricting them would break jobs that nobody wants to debug.

What ZoomEye contributes

A title query establishes the population. A hosting provider or country filter narrows it to instances that might belong to a known organisation, and a repeated query after remediation shows whether the exposure changed. Because the count is small, the measurement is manageable at the level of a single enterprise.

Limits

The figure is an indexed fingerprint and not a live check. It does not indicate version, configuration or the credentials stored on an instance, and this article makes no claim about any specific deployment.

References

• ZoomEye search syntax and field reference: https://www.zoomeye.ai/doc
• Rundeck documentation and release notes: https://docs.rundeck.com/