CVE-2026-32604
1 advisory.
Maven/io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo CVE-2026-32604: critical 9.9
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Action: Upgrade io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo to 2026.0.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.0.1 | - |
Fixed versions
| 2026.0.1 |
Sources
- osv: GHSA-x3j7-7pgj-h87r
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r
- https://nvd.nist.gov/vuln/detail/CVE-2026-32604
- https://github.com/spinnaker/spinnaker
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2
- https://zeropath.com/blog/spinnaker-rce-production-compromise
CVE-2026-32604 · published · modified · JSON