CLEANSTART-2026-YZ58558: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combin...
Security vulnerability affects the rundeck package. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Frequently Asked Questions
What configuration is required for this issue to be relevant?
The affected application must use Eclipse Jetty security components and define two or more security constraints that have the same http-method-omission set and no url-patterns. The issue concerns how Jetty combines those constraints.
How can I determine whether my deployment may be affected?
Review the application's deployed security-constraint configuration for multiple constraints with identical http-method-omission values and no url-patterns. Also verify whether the Rundeck deployment includes an affected Eclipse Jetty jetty-security or jetty-eeN-security component.