CLEANSTART-2026-FR53288: WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Q: Which deployments are exposed?

The affected scenario is a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. The provided data identifies the rundeck package but does not specify affected versions or deployment defaults.

Q: What request condition is involved in exploitation?

The bypass occurs in a pre-flight request and concerns a header predicate. No authentication, user interaction, or other attacker prerequisites are provided beyond the critical vector indicating network access and low attack complexity.

Q: How can I determine whether my application may be affected?

Check whether the application uses WebFlux functional endpoints and is deployed with DispatcherServlet. If both conditions apply, treat the deployment as potentially vulnerable; the provided data does not include a version-based detection method or workaround.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47892

Frequently Asked Questions

Which deployments are exposed?

The affected scenario is a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. The provided data identifies the rundeck package but does not specify affected versions or deployment defaults.

What request condition is involved in exploitation?

The bypass occurs in a pre-flight request and concerns a header predicate. No authentication, user interaction, or other attacker prerequisites are provided beyond the critical vector indicating network access and low attack complexity.

How can I determine whether my application may be affected?

Check whether the application uses WebFlux functional endpoints and is deployed with DispatcherServlet. If both conditions apply, treat the deployment as potentially vulnerable; the provided data does not include a version-based detection method or workaround.

CLEANSTART-2026-FR53288: WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What request condition is involved in exploitation?

How can I determine whether my application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What request condition is involved in exploitation?

How can I determine whether my application may be affected?