CLEANSTART-2026-JG78421: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability

Q: Does exploitation require an authenticated account or user interaction?

No. The vulnerability is rated PR:N and UI:N, indicating no prior privileges or user interaction are required. Exploitation complexity is rated high (AC:H).

Q: Can this be exploited remotely?

Yes. The attack vector is network-based (AV:N), so a reachable affected deployment may be exposed to remote attack attempts.

Q: What security impact is indicated if exploitation succeeds?

The rating indicates high confidentiality and integrity impact (C:H and I:H). No availability impact is indicated (A:N).

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-41707

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

No. The vulnerability is rated PR:N and UI:N, indicating no prior privileges or user interaction are required. Exploitation complexity is rated high (AC:H).

Can this be exploited remotely?

Yes. The attack vector is network-based (AV:N), so a reachable affected deployment may be exposed to remote attack attempts.

What security impact is indicated if exploitation succeeds?

The rating indicates high confidentiality and integrity impact (C:H and I:H). No availability impact is indicated (A:N).

CLEANSTART-2026-JG78421: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

Can this be exploited remotely?

What security impact is indicated if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

Can this be exploited remotely?

What security impact is indicated if exploitation succeeds?