{"id":"CVE-2026-32604","aliases":["EUVD-2026-23963","GHSA-x3j7-7pgj-h87r"],"status":"published","title":"Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00619,"percentile":0.49973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2026-04-20T20:00:57Z","modified":"2026-10-28T10:49:14Z","exploits":[{"source":"pocgithub","id":"ZeroPathAI/spinnaker-poc","title":"ZeroPathAI/spinnaker-poc","date":"2026-04-15","url":"https://github.com/ZeroPathAI/spinnaker-poc"}],"fixes":[{"ecosystem":"Maven","package":"io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo","fixed_in":["2026.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.0.1"}]}],"versions":["2026.0-0","2026.0-1","2026.0-10","2026.0-11","2026.0-12","2026.0-13","2026.0-14","2026.0-15","2026.0-16","2026.0-17","2026.0-18","2026.0-19","2026.0-2","2026.0-20","2026.0-21","2026.0-22","2026.0-23","2026.0-3","2026.0-4","2026.0-5","2026.0-6","2026.0-7","2026.0-8","2026.0-9","2026.0.0","main-132","main-133","main-134","main-135","main-136","main-137","main-139","main-140","main-141","main-142","main-143","main-144","main-145","main-146","main-147","main-148","main-149","main-150","main-151","main-152","main-153","main-154","main-155","main-156","main-157","main-158","main-159","main-160","main-161","main-162","main-163","main-164","main-165","main-166","main-167","main-168","main-169","main-170","main-171","main-172","main-173","main-174","main-175","main-176","main-177","main-178","main-179","main-180","main-181","main-182","main-183","main-184","main-185","main-186","main-187","main-188","main-189","main-190","main-191","main-192","main-193","main-194","main-195","main-196","main-197","main-198","main-199","main-200","main-201","main-202","main-203","main-204","main-205","main-206","main-207","main-208","main-209","main-210","main-211","main-212","main-213","main-214","main-215","main-216","main-217","main-218","main-219","main-220","main-222","main-223","main-224","main-225","main-226","main-227","main-228","main-229","main-230","main-231","main-232","main-233","main-234","main-235","main-236","main-237","main-239","main-241","main-272","main-273","main-274","main-275","main-276","main-277","main-278","main-279","main-280","main-281","main-282","main-283","main-284","main-285","main-286","main-287","main-288","main-289","main-290","main-291","main-292","main-293","main-294","main-295","main-296","main-297","main-298","main-299","main-300","main-301","main-302","main-303","main-304","main-305","main-306","main-307","main-308","main-309","main-310","main-311","main-312","main-313","main-314","main-315","main-316","main-317","main-318","main-319","main-320","main-321","main-322","main-323","main-324","main-325","main-326","main-327","main-328","main-329","main-330","main-331","main-332","main-333","main-334","main-335","main-336","main-337"]}],"products":[{"vendor":"linuxfoundation","product":"spinnaker"},{"vendor":"spinnaker","product":"spinnaker"}],"references":[{"url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://zeropath.com/blog/spinnaker-rce-production-compromise","tags":["article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32604","tags":["advisory"]},{"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x3j7-7pgj-h87r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32604.json","tags":["advisory"]},{"url":"https://github.com/spinnaker/spinnaker","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-32604","title":"Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","status":"published","published":"2026-04-20T20:00:57.517Z","modified":"2026-04-23T16:28:39.326Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-23963","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","status":"published","published":"2026-04-20T20:00:57Z","modified":"2026-04-23T16:28:39Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:19.171803Z"}],"ghsa":[{"id":"GHSA-x3j7-7pgj-h87r","title":"Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","status":"published","published":"2026-04-21T14:48:38Z","modified":"2026-04-27T16:30:35Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:58.897998Z"}],"nvd":[{"id":"CVE-2026-32604","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","status":"published","published":"2026-04-20T21:16:32.457Z","modified":"2026-06-17T10:36:05.033Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"CVE-2026-32604","title":"Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","status":"published","published":"2026-04-20T20:00:57.517Z","modified":"2026-10-28T10:49:14.580253251Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"GHSA-x3j7-7pgj-h87r","title":"Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","status":"published","published":"2026-04-21T14:48:38Z","modified":"2026-09-10T03:51:03.86282831Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}