Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
SonarQube could let attackers run code
published 1 month ago
Summary
The SonarQube product includes a version of the Bouncy Castle Java library that is vulnerable. An attacker could exploit this to execute their own code on your server, potentially compromising data. Update SonarQube to the latest version or apply the vendor's security patch as soon as possible.
What to do
- Update cleanstart sonarqube to version 26.6.0.123539-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | sonarqube |
< 26.6.0.123539-r0 Fix: upgrade to 26.6.0.123539-r0
|
Original advisory text
In Bouncy Castle for Java before 1
Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-QX66145 · OSV
Track software like this
Free during beta