CLEANSTART-2026-UR46643: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Q: Which Rundeck deployments are exposed?

Exposure applies to deployments where the application constructs a Content-Disposition response header using an untrusted file name. The provided information does not state whether this behavior is present in a default configuration.

Q: What must an attacker be able to control?

An attacker needs to supply a malicious file name that is used to build a Content-Disposition header value. No authentication or user interaction is indicated by the supplied vector, but exploitation is rated high complexity.

Q: How can I determine whether my deployment is affected?

Review application paths that accept or generate file names and return responses with a Content-Disposition header. A deployment is in scope if an untrusted file name can reach that header value without safe handling.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59314

Frequently Asked Questions

Which Rundeck deployments are exposed?

Exposure applies to deployments where the application constructs a Content-Disposition response header using an untrusted file name. The provided information does not state whether this behavior is present in a default configuration.

What must an attacker be able to control?

An attacker needs to supply a malicious file name that is used to build a Content-Disposition header value. No authentication or user interaction is indicated by the supplied vector, but exploitation is rated high complexity.

How can I determine whether my deployment is affected?

Review application paths that accept or generate file names and return responses with a Content-Disposition header. A deployment is in scope if an untrusted file name can reach that header value without safe handling.

CLEANSTART-2026-UR46643: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Rundeck deployments are exposed?

What must an attacker be able to control?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which Rundeck deployments are exposed?

What must an attacker be able to control?

How can I determine whether my deployment is affected?