CLEANSTART-2026-HY42782: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Q: Which Rundeck deployments are exposed?

Exposure applies to applications that evaluate Spring Expression Language (SpEL) expressions with SimpleEvaluationContext while the SpEL expression compiler is active. The provided data does not identify affected Rundeck versions or indicate whether this configuration is enabled by default.

Q: What does an attacker need to exploit this issue?

The vulnerability is network-accessible and requires neither authentication nor user interaction, according to the supplied CVSS vector. Exploitation depends on the application evaluating relevant SpEL expressions under the affected conditions.

Q: What is the potential impact?

The supplied severity vector indicates high integrity and availability impact, with no confidentiality impact. The vulnerability is rated critical with a CVSS score of 9.1.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59283

Frequently Asked Questions

Which Rundeck deployments are exposed?

Exposure applies to applications that evaluate Spring Expression Language (SpEL) expressions with SimpleEvaluationContext while the SpEL expression compiler is active. The provided data does not identify affected Rundeck versions or indicate whether this configuration is enabled by default.

What does an attacker need to exploit this issue?

The vulnerability is network-accessible and requires neither authentication nor user interaction, according to the supplied CVSS vector. Exploitation depends on the application evaluating relevant SpEL expressions under the affected conditions.

What is the potential impact?

The supplied severity vector indicates high integrity and availability impact, with no confidentiality impact. The vulnerability is rated critical with a CVSS score of 9.1.

CLEANSTART-2026-HY42782: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Rundeck deployments are exposed?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which Rundeck deployments are exposed?

What does an attacker need to exploit this issue?

What is the potential impact?