CLEANSTART-2026-FC38758: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Q: Which deployments are exposed to this issue?

The affected package is cleanstart/rundeck. Exposure applies to Spring MVC or WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and render field errors through the no-argument Errors path.

Q: What must an attacker do to exploit the issue?

The vector is network-accessible and requires low attack complexity and no privileges, but user interaction is required. The provided data does not specify the form of that interaction or the exact attacker-controlled input.

Q: Is there evidence that a default Rundeck configuration is affected?

No. The available information identifies a specific Spring MVC/WebFlux error-handling pattern, but does not state whether it is present or enabled by default in cleanstart/rundeck.

Q: How can I determine whether my application is affected?

Review Spring MVC and WebFlux code paths for data-binding Errors instances obtained with HTML escaping enabled, then check whether field errors are rendered using the no-argument Errors mechanism. The supplied data does not provide affected versions or an automated detection method.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59281

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected package is cleanstart/rundeck. Exposure applies to Spring MVC or WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and render field errors through the no-argument Errors path.

What must an attacker do to exploit the issue?

The vector is network-accessible and requires low attack complexity and no privileges, but user interaction is required. The provided data does not specify the form of that interaction or the exact attacker-controlled input.

Is there evidence that a default Rundeck configuration is affected?

No. The available information identifies a specific Spring MVC/WebFlux error-handling pattern, but does not state whether it is present or enabled by default in cleanstart/rundeck.

How can I determine whether my application is affected?

Review Spring MVC and WebFlux code paths for data-binding Errors instances obtained with HTML escaping enabled, then check whether field errors are rendered using the no-argument Errors mechanism. The supplied data does not provide affected versions or an automated detection method.

CLEANSTART-2026-FC38758: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the issue?

Is there evidence that a default Rundeck configuration is affected?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the issue?

Is there evidence that a default Rundeck configuration is affected?

How can I determine whether my application is affected?