CLEANSTART-2026-GZ93860: In Bouncy Castle for Java before 1

Q: What level of access does an attacker need to exploit this issue?

The supplied vector indicates network-based exploitation with low attack complexity. It does not require prior privileges or user interaction.

Q: What is the expected security impact if exploitation succeeds?

The vector indicates high impact to integrity. It indicates no impact to confidentiality or availability.

Q: Which tracked software should be assessed?

The advisory lists cleanstart/wso2am, cleanstart/rundeck, and cleanstart/wso2mi. It states that the underlying CVE affects multiple packages.

Q: Does this record identify a complete fixed version?

No. The supplied title is truncated at “before 1” and does not provide a complete affected or fixed version number.

Published Nov 13, 2026

Updated

CVE-2026-71889 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

cleanstart/rundeck<6.0.1-r11

6.0.1-r11

cleanstart/wso2mi<4.6.0-r9

4.6.0-r9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.0.1-r11
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.6.0-r9

Event History

Nov 13, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71889

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?