GitHub Advisoryadvisory · Maven

GHSA-x3j7-7pgj-h87r Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

CRITICAL Published 2026-04-21 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-32604
Ecosystem
Maven
Packages
io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2026-04-21

Affected packages

• Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo: < 2026.0.1 → fixed in 2026.0.1

Description

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

Related

Alias · CVE (1)

  • CVE-2026-32604 Spinnaker is an open source, multi-cloud continuous delivery platform. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References