CVE-2026-54555: rtk Permission Splitter Authorization Bypass via Shell Metaconstructs

Technical summary

The vulnerability stems from insufficient parsing of shell metaconstructs in the permission splitter component prior to version 0.42.2. Bash recognizes several patterns as command execution boundaries—such as command substitution, process substitution, and conditional execution operators—that allow embedding one command within another. The permission splitter failed to conservatively reject or split these constructs. When a rewritten command passed through the filter, rtk returned exit code 0 even when a hidden command remained embedded in the payload. The Claude hook then issued a permissionDecision of 'allow' without user intervention. The underlying rewritten command, still containing the hidden payload, executed with the privileges of the rtk process, bypassing the intended authorization workflow. This is classified as an authorization bypass (CWE-863).

Business impact

Organizations using rtk to govern command execution and control what users can run via LLM integration face a direct authorization bypass. An attacker who can interact with the LLM-integrated environment can execute arbitrary commands by wrapping them in shell constructs that evade the permission filter. This undermines the entire security model of using rtk as a permission boundary. Depending on the privileges of the rtk process and the sensitivity of systems it touches, an attacker could gain unauthorized access to data, modify configuration, or pivot to further systems. Trust in the permission system is compromised until patching is complete.

Affected systems

All versions of rtk prior to 0.42.2 are vulnerable. The issue affects deployments where rtk is used to control command execution in LLM contexts (such as Claude integrations). Systems running rtk 0.42.2 and later are patched. No indication of widespread exploitation in the wild, and the vulnerability has not been designated for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.

Exploitability

Exploitation requires local access to an environment where rtk is running and where an LLM (such as Claude) is integrated to execute commands via rtk. The attacker does not need elevated privileges to trigger the vulnerability—they interact through the normal LLM interface. The attack is straightforward: craft a command that opens with an approved prefix and embeds a hidden command using a Bash metaconstruct (e.g., command substitution or process substitution). The permission filter passes it, and the hidden command runs. While the attack surface is limited to users with access to the LLM integration, the barrier to execution is low once access is present.

Remediation

Immediately upgrade rtk to version 0.42.2 or later. This release fixes the permission splitter to properly recognize and conservatively handle shell execution boundaries that Bash respects. After patching, verify that the permission system is functioning as intended by testing with known-good and known-bad command patterns. No workaround exists for earlier versions; patching is the only reliable fix.

Patch guidance

1. Audit your environment to identify all instances of rtk and their current versions. 2. Plan a controlled upgrade to 0.42.2, testing in a non-production environment first if possible. 3. After upgrade, restart any services or processes that depend on rtk. 4. Confirm that the permission splitter is correctly rejecting or modifying commands that previously would have bypassed the filter. 5. Review audit logs for any suspicious command patterns that may have exploited this vulnerability prior to the patch.

Detection guidance

Monitor rtk logs for commands that contain shell metaconstructs (command substitution with $(...) or backticks, process substitution with <(...) or >(...), and conditional operators like && or ||) combined with allowed command prefixes. Commands that were approved but contain hidden execution patterns are a red flag. If you have access to LLM interaction logs, look for prompts that ask the model to construct commands with embedded shell syntax. Behavioral monitoring of actual command execution can reveal unexpected behavior that rtk's filter was supposed to prevent.

Why prioritize this

This is a HIGH-severity authorization bypass in a permission-control mechanism. The CVSS score of 7.8 reflects high impact (confidentiality, integrity, and availability all at risk) and low attack complexity. The vulnerability directly subverts the security boundary that rtk is intended to enforce. Any organization relying on rtk for access control should treat this as critical and prioritize patching within their next maintenance window. The fact that it is not yet in CISA's KEV catalog does not diminish the urgency for internal deployments.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) is justified by: AV:L (attack via local access, reflecting the requirement to interact with the LLM integration), AC:L (low complexity—no special conditions required to trigger), PR:N (no privileges required), UI:R (user interaction required—the user must submit a command through the LLM), and S:U (impact is confined to the vulnerable component and systems it controls). The impact ratings—C:H, I:H, A:H—reflect that a successful exploit allows arbitrary command execution, compromising confidentiality (data access), integrity (command execution and modification), and availability (potential denial of service).

Frequently asked questions