CLEANSTART-2026-UM12038: When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required)
Security vulnerability affects the rundeck package. When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Frequently Asked Questions
What level of attacker access is indicated by the available severity data?
The vector indicates network-based exploitation with no required privileges and no user interaction. It also indicates that additional attack requirements must be present, but the available data does not specify what those requirements are.
What security impact is indicated?
The available severity data indicates a high confidentiality impact. It does not indicate integrity or availability impact, and it indicates no scope change.
How can I determine whether my deployment may be affected?
Review whether the Rundeck package uses Jetty HttpClient to make outbound requests through a forward proxy and whether that proxy interaction can result in HTTP 407 responses. The provided data does not identify affected versions or a fixed version.