CLEANSTART-2026-NF51702: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by u...
Security vulnerability affects the rundeck package. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to send HTTP requests using method names that are substrings of methods covered by a Jakarta `http-method-omission` constraint. No authentication or user interaction is required according to the supplied severity vector.
Which deployments are exposed?
Deployments of the affected Rundeck package are exposed where the underlying Jetty security or servlet components use Jakarta security constraints defined with `http-method-omission`. The provided data does not identify affected versions or state whether such constraints are enabled by default.
What is the likely security impact?
The vulnerability can bypass intended HTTP-method access constraints, with low impact to confidentiality and integrity. The supplied vector indicates no availability impact and no impact beyond the vulnerable component.