CLEANSTART-2026-YG37337: Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Q: Which deployments are exposed?

Deployments are exposed when they use Spring MVC UrlFileNameViewController, map it with an end-of-path pattern, and do not configure a prefix. The affected software is identified as cleanstart/rundeck.

Q: What does an attacker need to exploit this issue?

The supplied vector indicates network access, low attack complexity, no required privileges, and user interaction. Successful exploitation can affect confidentiality and integrity, but not availability.

Q: How can I determine whether my deployment is affected?

Review Spring MVC controller mappings for UrlFileNameViewController. Confirm whether it is mapped with an end-of-path and whether a prefix has been configured; the vulnerable condition requires both the end-of-path mapping and absence of a prefix.

Q: Are default installations known to be affected?

The available data does not state whether the vulnerable controller mapping and missing-prefix configuration are present by default.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47887

Frequently Asked Questions

Which deployments are exposed?

Deployments are exposed when they use Spring MVC UrlFileNameViewController, map it with an end-of-path pattern, and do not configure a prefix. The affected software is identified as cleanstart/rundeck.

What does an attacker need to exploit this issue?

The supplied vector indicates network access, low attack complexity, no required privileges, and user interaction. Successful exploitation can affect confidentiality and integrity, but not availability.

How can I determine whether my deployment is affected?

Review Spring MVC controller mappings for UrlFileNameViewController. Confirm whether it is mapped with an end-of-path and whether a prefix has been configured; the vulnerable condition requires both the end-of-path mapping and absence of a prefix.

Are default installations known to be affected?

The available data does not state whether the vulnerable controller mapping and missing-prefix configuration are present by default.

CLEANSTART-2026-YG37337: Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my deployment is affected?

Are default installations known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my deployment is affected?

Are default installations known to be affected?