Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Rundeck could be exploited through old Bouncy Castle library

published 14 days ago
Summary

The Rundeck automation tool includes an outdated version of the Bouncy Castle Java library. This can let a malicious user run unwanted code on the server. Update Rundeck to a version that ships with the latest Bouncy Castle or replace the library with a current release.

What to do
  • Update cleanstart rundeck to version 6.1.0-r2.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart rundeck < 6.1.0-r2
Fix: upgrade to 6.1.0-r2
Original advisory text
In Bouncy Castle for Java before 1
Security vulnerability affects the rundeck package. In Bouncy Castle for Java before 1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.3 High
Timeline
Published22 Oct 2026
Updated22 Oct 2026
First seen22 Oct 2026
Sources
CLEANSTART-2026-XF81157 · OSV
Track software like this
Free during beta