Question

Rundeck Vulnerability reported - CVE-2026-22732

Hi all, quick vulnerability question.

Our vulnerability software has flagged up Rundeck v5.20 with CVE-2026-22732 because of the component spring-security-web-5.8.15.jar

I could not find anything about this CVE in this forum or Rundeck web page.

How can we find out if there’s a fix for this coming up soon?

Is there a place to report this?

Thanks!

Hi @Carlos.A I've reported this to the engineering team. Thanks a lot for your feedback!

Really appreciate it @MegaDrive68k

Does PagerDuty have an SLA for remediating critical CVEs?

Our Security department is pretty strict, and it’s mandatory for us to remediate CVEs on our live systems.

Thanks again, Carlos

Join PagerDuty Commons