CLEANSTART-2026-DR60897: In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

Q: Which deployments are realistically exposed to this issue?

The affected software list identifies cleanstart/kafka and cleanstart/rundeck. Exposure depends on whether the deployment uses the affected Eclipse Jetty server or proxy host whitelist or blacklist controls.

Q: What does an attacker need to exploit the issue?

An attacker needs to send traffic using a host value whose capitalization differs from a host allowed or denied by the configured list. The case-sensitive comparison can allow that differently cased host value to bypass the intended rule.

Q: Are default configurations known to be affected?

The available data does not state whether a default configuration enables or relies on a host whitelist or blacklist. The issue is relevant where those host filtering controls are configured.

Q: How can I determine whether my environment is affected?

Check whether cleanstart/kafka or cleanstart/rundeck uses Eclipse Jetty jetty-server or jetty-proxy and whether host whitelist or blacklist rules are configured. Test or review whether host entries that differ only in letter case are evaluated differently from the configured entries.

Published Nov 11, 2026

Updated

CVE-2026-18660 affects multiple packages. In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/kafka<4.3.2-r0

4.3.2-r0

cleanstart/kafka<4.0.2-r6

4.0.2-r6

cleanstart/kafka<4.4.0-r1

4.4.0-r1

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.3.2-r0
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.0.2-r6
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.4.0-r1
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18660

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

The affected software list identifies cleanstart/kafka and cleanstart/rundeck. Exposure depends on whether the deployment uses the affected Eclipse Jetty server or proxy host whitelist or blacklist controls.

What does an attacker need to exploit the issue?

An attacker needs to send traffic using a host value whose capitalization differs from a host allowed or denied by the configured list. The case-sensitive comparison can allow that differently cased host value to bypass the intended rule.

Are default configurations known to be affected?

The available data does not state whether a default configuration enables or relies on a host whitelist or blacklist. The issue is relevant where those host filtering controls are configured.

How can I determine whether my environment is affected?

Check whether cleanstart/kafka or cleanstart/rundeck uses Eclipse Jetty jetty-server or jetty-proxy and whether host whitelist or blacklist rules are configured. Test or review whether host entries that differ only in letter case are evaluated differently from the configured entries.

CLEANSTART-2026-DR60897: In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to exploit the issue?

Are default configurations known to be affected?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to exploit the issue?

Are default configurations known to be affected?

How can I determine whether my environment is affected?