CLEANSTART-2026-ZN37384: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces

Q: Who is exposed to this issue?

Deployments of the cleanstart/rundeck package are exposed when they use Spring Security's embedded UnboundID LDAP server through UnboundIdContainer. The LDAP listener binds to all available network interfaces, making it reachable beyond localhost where network access permits.

Q: What does an attacker need to exploit it?

The reported vector is network-accessible and requires no privileges or user interaction. Exploitation depends on an attacker being able to reach the embedded LDAP listener.

Q: What should teams check while assessing exposure?

Determine whether Rundeck is using UnboundIdContainer and identify the network interfaces and firewall rules applicable to its embedded LDAP listener. Also review whether the automatically registered administrative credential could be used by systems able to reach that listener.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59270

Frequently Asked Questions

Who is exposed to this issue?

Deployments of the cleanstart/rundeck package are exposed when they use Spring Security's embedded UnboundID LDAP server through UnboundIdContainer. The LDAP listener binds to all available network interfaces, making it reachable beyond localhost where network access permits.

What does an attacker need to exploit it?

The reported vector is network-accessible and requires no privileges or user interaction. Exploitation depends on an attacker being able to reach the embedded LDAP listener.

What should teams check while assessing exposure?

Determine whether Rundeck is using UnboundIdContainer and identify the network interfaces and firewall rules applicable to its embedded LDAP listener. Also review whether the automatically registered administrative credential could be used by systems able to reach that listener.

CLEANSTART-2026-ZN37384: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What should teams check while assessing exposure?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What should teams check while assessing exposure?