CLEANSTART-2026-AB33619: Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object

Q: Which Cleanstart components should be prioritized for review?

The affected software list identifies cleanstart/kafka, cleanstart/solr, and cleanstart/rundeck. Review deployments of each component for use of Eclipse Jetty session authentication and serialized session data.

Q: What access does an attacker need to exploit this issue?

The provided CVSS vector indicates local attack vector, low attack complexity, high privileges required, and no user interaction. This suggests exploitation requires an attacker who already has substantial access to the affected environment.

Q: What is the expected impact if exploited?

The vector indicates high impact to confidentiality, with no indicated integrity or availability impact. The described issue involves authentication credentials being retained in a serializable SessionAuthentication object.

Published Nov 11, 2026

Updated

CVE-2026-19864 affects multiple packages. Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/kafka<4.3.2-r0

4.3.2-r0

cleanstart/kafka<4.0.2-r6

4.0.2-r6

cleanstart/solr<10.0.0-r14

10.0.0-r14

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.3.2-r0
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.0.2-r6
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.0.0-r14
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-19864

Frequently Asked Questions

Which Cleanstart components should be prioritized for review?

The affected software list identifies cleanstart/kafka, cleanstart/solr, and cleanstart/rundeck. Review deployments of each component for use of Eclipse Jetty session authentication and serialized session data.

What access does an attacker need to exploit this issue?

The provided CVSS vector indicates local attack vector, low attack complexity, high privileges required, and no user interaction. This suggests exploitation requires an attacker who already has substantial access to the affected environment.

What is the expected impact if exploited?

The vector indicates high impact to confidentiality, with no indicated integrity or availability impact. The described issue involves authentication credentials being retained in a serializable SessionAuthentication object.

CLEANSTART-2026-AB33619: Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Cleanstart components should be prioritized for review?

What access does an attacker need to exploit this issue?

What is the expected impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which Cleanstart components should be prioritized for review?

What access does an attacker need to exploit this issue?

What is the expected impact if exploited?