CLEANSTART-2026-PV03102: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)
Published Nov 7, 2026
·Updated
Security vulnerability affects the sonarqube package. Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586).
Affected Software
1 affected componentFixes available
cleanstart/sonarqube<26.8.0.126808-r5
26.8.0.126808-r5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.8.0.126808-r5
Event History
Nov 7, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software