A security vulnerability in Rundeck affects versions prior to 6.3.0-r0 and 6.1.0-r4. It involves Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors method. This can lead to partial confidentiality and integrity impacts. The vulnerability has a medium severity with a CVSS score of 6.1 and has been fixed in versions 6.3.0-r0 and 6.1.0-r4.
A security vulnerability in Rundeck affects applications that evaluate user-supplied Spring Expression Language (SpEL) expressions. Specifically, a Denial of Service (DoS) condition may occur when the power operator (^) is used with BigDecimal or BigInteger operands and a large exponent value. This flaw has been assigned CVE-2026-47886 and carries a high severity rating with a CVSS score of 7.5. Fixed versions 6.3.0-r0 and 6.1.0-r4 are available to address this issue.
A security vulnerability in Rundeck affects the PartEventHttpMessageReader component of Spring WebFlux. Specifically, when the maxInMemorySize parameter is set to -1, the maxPartSize limit is not enforced, potentially allowing larger parts than intended. This flaw is present in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4. The vulnerability has a high severity score of 7.5 and impacts the integrity of the application without affecting confidentiality or availability.
A high-severity denial of service (DoS) vulnerability exists in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4. The issue arises from the use of Spring Framework's data binding infrastructure, which applies user-supplied property paths onto target objects. This can be exploited to cause a DoS condition.
A security vulnerability in Rundeck affects versions prior to 6.3.0-r0 and 6.1.0-r4. The issue involves a WebFlux application running on the Jetty 12 Core reactive adapter that serializes response cookies without including the SameSite attribute. This can lead to security risks related to cookie handling. The vulnerability has a high severity score of 7.5 and is addressed in the fixed versions 6.3.0-r0 and 6.1.0-r4.
A security vulnerability in Rundeck's Spring WebFlux application that supports WebSocket connections may indirectly expose sensitive user information. This occurs because request headers are included in exception reasons, potentially leaking data. The vulnerability affects versions prior to 6.3.0-r0 and 6.1.0-r4. A fix is available in these versions. The vulnerability has a high severity with a CVSS score of 7.5.
A security vulnerability in Rundeck's Spring RSocket application allows a memory leak when processing a malformed SETUP frame. This issue affects versions prior to 6.3.0-r0 and 6.1.0-r4. The vulnerability has a high severity score and can impact availability by exhausting memory resources. Fixed versions are available.
A critical security vulnerability (CVE-2026-47892) affects Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4. The issue involves a WebFlux application using functional endpoints deployed with DispatcherServlet, which may be vulnerable to a header predicate bypass in a pre-flight request. This flaw allows an attacker to potentially bypass security controls related to HTTP headers during CORS pre-flight checks. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Fixed versions 6.3.0-r0 and 6.1.0-r4 are available, and patches should be applied promptly.
A critical security vulnerability in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4 involves the use of XsltView in a Spring MVC application. This flaw can lead to server-side request forgery (SSRF) and remote code execution (RCE) if the application has a /** mapping that triggers view rendering without explicitly specifying the view name. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Fixed versions 6.3.0-r0 and 6.1.0-r4 address this issue.
A critical security vulnerability affects Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4. The issue involves Spring MVC applications using the functional web framework, which are susceptible to stream corruption when utilizing Server-Sent Events (SSE). This vulnerability has a high impact on confidentiality, integrity, and availability.
A critical security vulnerability exists in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4 where a Spring WebFlux application using the Aalto XML processor fails to properly enforce the maxInMemorySize limit when parsing XML input. This flaw can lead to severe impacts including confidentiality, integrity, and availability compromises. The issue has been fixed in versions 6.3.0-r0 and 6.1.0-r4.
A critical security vulnerability exists in Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4 where applications evaluating Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be susceptible to a safety guard bypass when the SpEL expression compiler is active. This vulnerability can lead to high impact on integrity and availability without requiring user interaction or privileges.
Rundeck versions prior to 6.3.0-r0 and 6.1.0-r4 are affected by a critical security vulnerability involving stream corruption in Spring MVC and WebFlux applications when using Server-Sent Events (SSE) with view fragments. This vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Fixed versions 6.3.0-r0 and 6.1.0-r4 are available.
CVE-2026-108104 is a medium severity vulnerability affecting multiple versions of the Xerial snappy-java package used in Kafka. The flaw impacts versions prior to 4.0.2-r6, 4.4.0-r1, 10.0.0-r12, 2.11.0-r3, and 6.1.0-r5. It has a CVSS score of 4.8 with low confidentiality and integrity impact and no availability impact. Fixed versions are available for all affected releases.
CVE-2026-90559 is a high-severity vulnerability affecting multiple Kafka packages that use snappy-java through version 1. The flaw impacts versions prior to fixed releases 4.4.0-r1, 10.0.0-r12, 2.11.0-r3, and 6.1.0-r5. The vulnerability does not affect confidentiality or integrity but causes a denial of service (availability impact). No known exploits are reported in the wild.
A security vulnerability has been identified in the Rundeck package related to the mwiede jsch component up to version 2. This flaw affects Rundeck versions prior to 6.1.0-r5. The vulnerability has a low severity score and impacts the integrity of the system without affecting confidentiality or availability. A patch fixing this issue is available in Rundeck version 6.1.0-r5.
CVE-2026-93879 is a security vulnerability affecting multiple packages, including keycloak and rundeck. The issue has been resolved in keycloak version 26.6.4-r8 and rundeck version 6.1.0-r5. Users running earlier versions are affected and should upgrade to the fixed releases to mitigate the vulnerability.
CVE-2026-76182 is a medium severity vulnerability affecting multiple Kafka package versions. It involves the Eclipse Jetty components `TryPathsHandler` and `TryFilesFilter`, which can be configured to forward requests to template URIs incorporating the request path. This behavior may lead to unintended request forwarding. Fixed versions are available.
CVE-2026-19864 is a vulnerability in Eclipse Jetty's SessionAuthentication component used by Kafka, where authentication credentials are retained in a serializable object. This could potentially expose sensitive authentication data. The issue affects multiple Kafka package versions prior to their respective fixed releases. A patch is available to address this vulnerability.
CVE-2026-97030 is a vulnerability in Kubernetes where a trusted template author may have created a valid template that improperly escapes the 'yield' keyword. This flaw affects multiple Kubernetes package versions prior to the fixed releases. The vulnerability has a medium severity with a CVSS score of 6.1, indicating limited confidentiality and integrity impact but no availability impact.