CLEANSTART-2026-ZE84338: Security fix for CVE-2026-93879 applied in: sonarqube 26.7.0.124771-r11, sonarqube 26.8.0.126808-r6

Q: Which package releases include the security fix?

The fix is applied in sonarqube 26.7.0.124771-r11 and sonarqube 26.8.0.126808-r6. The issue is resolved in later releases as well.

Q: How can I determine whether my deployment is affected?

Check the installed cleanstart/sonarqube package version. Deployments running a release earlier than the listed fixed builds should be reviewed and upgraded to a fixed or later release.

Published Nov 7, 2026

Updated

Security vulnerability affects the sonarqube package. This issue is resolved in later releases. See references for vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6

Event History

Nov 7, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93879

Frequently Asked Questions

Which package releases include the security fix?

The fix is applied in sonarqube 26.7.0.124771-r11 and sonarqube 26.8.0.126808-r6. The issue is resolved in later releases as well.

How can I determine whether my deployment is affected?