CLEANSTART-2026-TQ15680: In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case
Security vulnerability affects the rundeck package. In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of the cleanstart/rundeck package are affected when the relevant Jetty host whitelist or blacklist controls are in use. The issue concerns Jetty's jetty-server and jetty-proxy components across various versions.
What does an attacker need to do to bypass the host restriction?
An attacker must use a host value that differs from an allowed or blocked host only by letter case. Because matching is case-sensitive, that differently cased value can pass the whitelist or blacklist check.
Are all Rundeck deployments affected by default?
The available information identifies the flaw in host whitelist/blacklist handling, but does not state whether such controls are enabled by default. Exposure depends on use of the affected Jetty host filtering behavior.