CLEANSTART-2026-KA47707: Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Q: Which deployments are exposed?

The affected software is the cleanstart/rundeck package. Exposure applies where the application supports WebSocket connections through Spring WebFlux.

Q: What does an attacker need to exploit this issue?

The severity vector indicates network access is sufficient, with low attack complexity and no required privileges or user interaction. The reported impact is disclosure of indirectly sensitive user information through request headers included in an exception reason.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47893

Frequently Asked Questions

Which deployments are exposed?

The affected software is the cleanstart/rundeck package. Exposure applies where the application supports WebSocket connections through Spring WebFlux.

What does an attacker need to exploit this issue?

The severity vector indicates network access is sufficient, with low attack complexity and no required privileges or user interaction. The reported impact is disclosure of indirectly sensitive user information through request headers included in an exception reason.

CLEANSTART-2026-KA47707: Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?