CLEANSTART-2026-LU50496: Xerial snappy-java from 1

Q: Which deployed components should be prioritized for review?

Review deployments of cleanstart/rundeck, cleanstart/strimzi-kafka-operator, and cleanstart/solr that include Xerial snappy-java from version 1.

Q: What does exploitation require?

The available severity vector indicates network access is required, while no privileges or user interaction are required. Exploitation has high attack complexity.

Q: What is the potential impact if exploited?

The reported vector indicates low-impact confidentiality and integrity effects, with no availability impact.

Published Nov 13, 2026

Updated

CVE-2026-108104 affects multiple packages. Xerial snappy-java from 1. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/rundeck<6.0.1-r11

6.0.1-r11

cleanstart/strimzi-kafka-operator<0.51.0-r8

0.51.0-r8

cleanstart/solr<9.11.0-r0

9.11.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.0.1-r11
Upgrade
Upgrade cleanstart/strimzi-kafka-operator to a version that resolves this vulnerability.
Fixed in 0.51.0-r8
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 9.11.0-r0

Event History

Nov 13, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-108104

Frequently Asked Questions

Which deployed components should be prioritized for review?