CLEANSTART-2026-TX11041: In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web

Q: Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates the issue is remotely reachable over the network, has low attack complexity, and requires neither privileges nor user interaction.

Q: What is the expected security impact if exploited?

The CVSS vector indicates high impact to confidentiality and low impact to integrity. It indicates no availability impact and no impact to subsequent systems.

Q: Are affected versions, fixed versions, or temporary mitigations identified?

The provided data says the issue affects the cleanstart/rundeck package and references various Jetty annotation components, but does not identify affected or fixed version ranges, configuration prerequisites, or mitigations.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.

Affected Software

1 affected componentFixes available

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18661

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates the issue is remotely reachable over the network, has low attack complexity, and requires neither privileges nor user interaction.

What is the expected security impact if exploited?

The CVSS vector indicates high impact to confidentiality and low impact to integrity. It indicates no availability impact and no impact to subsequent systems.

Are affected versions, fixed versions, or temporary mitigations identified?

The provided data says the issue affects the cleanstart/rundeck package and references various Jetty annotation components, but does not identify affected or fixed version ranges, configuration prerequisites, or mitigations.

CLEANSTART-2026-TX11041: In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the expected security impact if exploited?

Are affected versions, fixed versions, or temporary mitigations identified?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the expected security impact if exploited?

Are affected versions, fixed versions, or temporary mitigations identified?