Vulnerability · Published Apr 20, 2026 · Assigned by GitHub_M
CVE-2026-32604Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Critical 10.0
In plain English
A critical-severity improper input validation in spinnaker from spinnaker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo | 2026.0.1 | GHSA-x3j7-7pgj-h87r |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r x_refsource_CONFIRM
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1 x_refsource_MISC
- https://zeropath.com/blog/spinnaker-rce-production-compromise