CLEANSTART-2026-BJ28796: In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/
Published Nov 13, 2026
·Updated
Security vulnerability affects the rundeck package. In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/.
Affected Software
1 affected componentFixes available
cleanstart/rundeck<6.0.1-r11
6.0.1-r11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Nov 13, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access does an attacker need to attempt exploitation?
The vector indicates network-based exploitation with no required privileges and no user interaction. It also indicates high attack complexity.
2
What security impact is indicated?
The severity is rated high at 8.2. The vector indicates high impact to confidentiality, with no indicated impact to integrity or availability.