CVE-2026-25534
2 advisories.
Maven/io.spinnaker.clouddriver:clouddriver-artifacts CVE-2026-25534: critical 9.1
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Action: Upgrade io.spinnaker.clouddriver:clouddriver-artifacts to 2025.2.4 (2025.2.x), 2025.3.1 (2025.3.x) or 2025.4.1 (2025.4.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2025.1.6 | 2025.2.4 | - |
| 2025.3.0 | 2025.3.1 | - |
| 2025.4.0 | 2025.4.1 | - |
Fixed versions
| 2025.2.4 | 2025.3.1 | 2025.4.1 |
Sources
- osv: GHSA-8r8j-gfhg-fw38
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h
- https://nvd.nist.gov/vuln/detail/CVE-2026-25534
- https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
- https://github.com/spinnaker/spinnaker
CVE-2026-25534 · published · modified · JSON
Maven/io.spinnaker.orca:orca-core CVE-2026-25534: critical 9.1
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Action: Upgrade io.spinnaker.orca:orca-core to 2025.2.4 (2025.2.x), 2025.3.1 (2025.3.x) or 2025.4.1 (2025.4.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2025.1.6 | 2025.2.4 | - |
| 2025.3.0 | 2025.3.1 | - |
| 2025.4.0 | 2025.4.1 | - |
Fixed versions
| 2025.2.4 | 2025.3.1 | 2025.4.1 |
Sources
- osv: GHSA-8r8j-gfhg-fw38#Maven/io.spinnaker.orca:orca-core
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h
- https://nvd.nist.gov/vuln/detail/CVE-2026-25534
- https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
- https://github.com/spinnaker/spinnaker
CVE-2026-25534 · published · modified · JSON