CLEANSTART-2026-AO46543: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Q: What application configuration makes this issue exploitable?

The application must use XsltView and have a "/**" mapping that results in view rendering while allowing the view name to remain unspecified explicitly.

Q: Does exploitation require authentication or user interaction?

No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact can successful exploitation have?

Successful exploitation can lead to server-side request forgery and remote code execution, with high impact to confidentiality, integrity, and availability.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47884

Frequently Asked Questions

What application configuration makes this issue exploitable?

The application must use XsltView and have a "/**" mapping that results in view rendering while allowing the view name to remain unspecified explicitly.

Does exploitation require authentication or user interaction?

No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What impact can successful exploitation have?

Successful exploitation can lead to server-side request forgery and remote code execution, with high impact to confidentiality, integrity, and availability.

CLEANSTART-2026-AO46543: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What application configuration makes this issue exploitable?

Does exploitation require authentication or user interaction?

What impact can successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

What application configuration makes this issue exploitable?

Does exploitation require authentication or user interaction?

What impact can successful exploitation have?