Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2026-32604 EUVD-2026-23963GHSA-x3j7-7pgj-h87r

Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

Published Apr 20, 2026 · Updated Apr 23, 2026 · Assigned by GitHub_M

Vendor: spinnaker Product: spinnaker Package: io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo Ecosystem: Maven

Description

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

Affected products

VendorProductAffectedFixed
spinnaker spinnaker < 2026.0.1, < 2025.4.2, < 2025.3.2, < 2026.1.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • ZeroPathAI/spinnaker-poc ★ 0 · Apr 15, 2026

    POCs for CVE-2026-32604 and CVE-2026-32613 which allow post-auth RCE and credential theft in Spinnaker

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo < 2026.0.1 2026.0.1 GHSA-x3j7-7pgj-h87r

References