CVE-2026-32613
CRITICAL EPSS 42.0%
Published Apr 20, 20262mo ago · Modified Jun 17, 20261w ago
9.9 CVSS 3.1
Published Apr 20, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago
Description
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
42.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
Affected Products 3
| Vendor | Product | Version | Range |
|---|---|---|---|
| linuxfoundation | spinnaker | * | <2025.3.2 |
| linuxfoundation | spinnaker | * | ≥2025.4.0 – <2025.4.2 |
| linuxfoundation | spinnaker | * | ≥2026.0.0 – <2026.0.1 |
References 5
- github.com https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
- github.com https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
- github.com https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
- github.com https://github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6
- zeropath.com https://zeropath.com/blog/spinnaker-rce-production-compromise
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.