Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. io.spinnaker.echo/echo-pipelinetriggers
  4. ›
  5. CVE-2026-32613

CVE-2026-32613: Spinnaker: RCE via expression parsing due to unrestricted context handling

April 21, 2026

Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. Unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enables a user to use arbitrary java classes which allow deep access to the system. This enables the ability to invoke commands, access files, etc.

References

  • github.com/advisories/GHSA-69rw-45wj-g4v6
  • github.com/spinnaker/spinnaker
  • github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
  • github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
  • github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
  • github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2
  • github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6
  • nvd.nist.gov/vuln/detail/CVE-2026-32613

Code Behaviors & Features

Detect and mitigate CVE-2026-32613 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 2026.0-0 before 2026.0.1, all versions starting from 2025.4-0 before 2025.4.2, all versions before 2025.3.2

Fixed versions

  • 2026.0.1
  • 2025.4.2
  • 2025.3.2

Solution

Upgrade to versions 2025.3.2, 2025.4.2, 2026.0.1 or above.

Impact 9.9 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

maven/io.spinnaker.echo/echo-pipelinetriggers/CVE-2026-32613.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 22 Apr 2026 12:18:51 +0000.