CLEANSTART-2026-RE71833: Several components in Spring Security compare security-sensitive values using standard string equality (String

Q: What would an attacker need to exploit this issue?

The vulnerability is remotely reachable and requires no privileges or user interaction, but exploitation has high attack complexity. The provided data does not identify the specific security-sensitive values or components involved.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation may expose confidential information. The supplied severity vector indicates no integrity or availability impact.

Q: Is a default Rundeck deployment known to be affected?

The provided data identifies the affected software as cleanstart/rundeck, but it does not state which versions, configurations, or default deployments are affected.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Several components in Spring Security compare security-sensitive values using standard string equality (String.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59276

Frequently Asked Questions

What would an attacker need to exploit this issue?

The vulnerability is remotely reachable and requires no privileges or user interaction, but exploitation has high attack complexity. The provided data does not identify the specific security-sensitive values or components involved.

What is the potential impact if exploitation succeeds?

Successful exploitation may expose confidential information. The supplied severity vector indicates no integrity or availability impact.

Is a default Rundeck deployment known to be affected?

The provided data identifies the affected software as cleanstart/rundeck, but it does not state which versions, configurations, or default deployments are affected.

CLEANSTART-2026-RE71833: Several components in Spring Security compare security-sensitive values using standard string equality (String

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What would an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Is a default Rundeck deployment known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What would an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Is a default Rundeck deployment known to be affected?