CVE-2026-32604: Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
(updated )
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.
References
- github.com/advisories/GHSA-x3j7-7pgj-h87r
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2
- github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r
- nvd.nist.gov/vuln/detail/CVE-2026-32604
- zeropath.com/blog/spinnaker-rce-production-compromise
Code Behaviors & Features
Detect and mitigate CVE-2026-32604 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →