CVE-2026-25534
Description
Impact
Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result.
Patches
This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.
Workarounds
You can disable the various artifacts on this system to work around these limits.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.spinnaker.clouddriver:clouddriver-artifactsMaven | < 2025.2.4 | 2025.2.4 |
io.spinnaker.clouddriver:clouddriver-artifactsMaven | >= 2025.3.0, < 2025.3.1 | 2025.3.1 |
io.spinnaker.clouddriver:clouddriver-artifactsMaven | >= 2025.4.0, < 2025.4.1 | 2025.4.1 |
io.spinnaker.orca:orca-coreMaven | < 2025.2.4 | 2025.2.4 |
io.spinnaker.orca:orca-coreMaven | >= 2025.3.0, < 2025.3.1 | 2025.3.1 |
io.spinnaker.orca:orca-coreMaven | >= 2025.4.0, < 2025.4.1 | 2025.4.1 |
Affected products
3- ghsa-coords2 versions
< 2025.2.4+ 1 more
- (no CPE)range: < 2025.2.4
- (no CPE)range: < 2025.2.4
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-8r8j-gfhg-fw38ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25534ghsaADVISORY
- github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0edanvdWEB
- github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38nvdWEB
- github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9hnvdWEB
News mentions
0No linked articles in our index yet.