CLEANSTART-2026-QV26311: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...

Q: Which applications are affected?

Applications using the rundeck package are affected if they instantiate AesBytesEncryptor with the two-argument constructor, or if they use CBC mode while passing a null IV generator.

Q: What configuration causes the weak encryption behavior?

The affected constructor and CBC configuration cause AES/CBC encryption to use a null, all-zero initialization vector. The provided data does not identify whether this behavior occurs in a default application configuration.

Q: What access does an attacker need?

The supplied severity vector indicates network attack access, low attack complexity, and low privileges required, with no user interaction required. It also indicates high confidentiality impact, with no integrity or availability impact.

Q: How can I determine whether my application is affected?

Review application code and configuration for AesBytesEncryptor usage. An application is affected when it uses the two-argument constructor or specifies CBC mode with a null IV generator.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47842

Frequently Asked Questions

Which applications are affected?

Applications using the rundeck package are affected if they instantiate AesBytesEncryptor with the two-argument constructor, or if they use CBC mode while passing a null IV generator.

What configuration causes the weak encryption behavior?

The affected constructor and CBC configuration cause AES/CBC encryption to use a null, all-zero initialization vector. The provided data does not identify whether this behavior occurs in a default application configuration.

What access does an attacker need?

The supplied severity vector indicates network attack access, low attack complexity, and low privileges required, with no user interaction required. It also indicates high confidentiality impact, with no integrity or availability impact.

How can I determine whether my application is affected?

Review application code and configuration for AesBytesEncryptor usage. An application is affected when it uses the two-argument constructor or specifies CBC mode with a null IV generator.

CLEANSTART-2026-QV26311: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are affected?

What configuration causes the weak encryption behavior?

What access does an attacker need?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are affected?

What configuration causes the weak encryption behavior?

What access does an attacker need?

How can I determine whether my application is affected?