CLEANSTART-2026-ES74296: In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web
Security vulnerability affects the rundeck package. In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The supplied vector indicates that exploitation is network-based, requires low attack complexity, and does not require privileges or user interaction.
What is the expected security impact if exploitation succeeds?
The supplied severity vector indicates high confidentiality impact and low integrity impact. It indicates no availability impact.
Can affected versions, default exposure, or compensating mitigations be determined from this advisory?
No. The provided data does not identify affected Rundeck versions, whether a default configuration is vulnerable, or any mitigation steps when patching is not immediately possible.