CLEANSTART-2026-DN99044: Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object
Published Nov 13, 2026
·Updated
Security vulnerability affects the rundeck package. Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object.
Affected Software
1 affected componentFixes available
cleanstart/rundeck<6.0.1-r11
6.0.1-r11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Nov 13, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access would an attacker need to exploit this issue?
The available CVSS data indicates local access and high privileges are required. No user interaction is required, but the attack also depends on additional conditions being present.
2
What is the expected security impact if exploitation succeeds?
The reported impact is high confidentiality impact. No integrity or availability impact is indicated.