CLEANSTART-2026-VE76815: In Bouncy Castle for Java before 1

Q: Which deployments should be prioritized for review?

The affected software list identifies cleanstart/apache-nifi and cleanstart/keycloak. Review deployments of those products that include Bouncy Castle for Java, particularly where they are reachable over the network.

Q: What level of access does an attacker need?

The supplied vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction. This means an unauthenticated remote attacker may be able to exploit an affected deployment if the vulnerable component is exposed.

Q: What is the expected security impact?

The vector indicates high impact to integrity, with no indicated impact to confidentiality or availability. The record does not provide further detail on the specific modification an attacker could perform.

Q: Is exploit availability known?

No. The exploit-maturity metric is marked unknown in the supplied vector.

Published Nov 11, 2026

Updated

CVE-2026-71888 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

cleanstart/keycloak<26.6.4-r8

26.6.4-r8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3
Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.6.4-r8

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71888

Frequently Asked Questions

Which deployments should be prioritized for review?

The affected software list identifies cleanstart/apache-nifi and cleanstart/keycloak. Review deployments of those products that include Bouncy Castle for Java, particularly where they are reachable over the network.

What level of access does an attacker need?

The supplied vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction. This means an unauthenticated remote attacker may be able to exploit an affected deployment if the vulnerable component is exposed.

What is the expected security impact?

The vector indicates high impact to integrity, with no indicated impact to confidentiality or availability. The record does not provide further detail on the specific modification an attacker could perform.

Is exploit availability known?

No. The exploit-maturity metric is marked unknown in the supplied vector.

CLEANSTART-2026-VE76815: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

What level of access does an attacker need?

What is the expected security impact?

Is exploit availability known?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What level of access does an attacker need?

What is the expected security impact?

Is exploit availability known?