{"id":"CVE-2026-32613","summary":"Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling","details":"Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.","aliases":["GHSA-69rw-45wj-g4v6"],"modified":"2026-07-17T07:03:24.488992Z","published":"2026-04-20T20:07:24.697Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32613.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32613.json"},{"type":"ADVISORY","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32613"},{"type":"ARTICLE","url":"https://zeropath.com/blog/spinnaker-rce-production-compromise"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spinnaker/spinnaker","events":[{"introduced":"0"},{"fixed":"8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa"},{"introduced":"6465902a6651ea50fa821259c7bbe68475e49251"},{"fixed":"d86027a6400811d59c8933306bfda87d8b4e20d3"},{"introduced":"6e1a64976a812b9dab7b61d08e96f0b22b9ed24c"},{"fixed":"45754bc9d83fef7dd6dc8653b375abe5c3a55a50"}],"database_specific":{"cpe":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2025.3.2"},{"introduced":"2025.4.0"},{"fixed":"2025.4.2"},{"introduced":"2026.0.0"},{"fixed":"2026.0.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["gate-2026.0-4","gate-2025.4-3","halyard-2026.0-4","echo-2026.0-3","clouddriver-2026.0-4","halyard-2025.4-7","echo-2025.4-3","clouddriver-2025.4-6","bn-spin-release-2026.0.x-3","gate-2026.0-3","rosco-2026.0.0","rosco-2026.0-3","orca-2026.0.0","orca-2026.0-2","keel-2026.0.0","keel-2026.0-2","kayenta-2026.0.0","kayenta-2026.0-2","igor-2026.0.0","igor-2026.0-2","halyard-2026.0.0","halyard-2026.0-3","gate-2026.0.0","gate-2026.0-2","front50-2026.0.0","front50-2026.0-2","fiat-2026.0.0","fiat-2026.0-2","echo-2026.0.0","echo-2026.0-2","clouddriver-2026.0.0","clouddriver-2026.0-3","rosco-2025.3-2","orca-2025.3-3","keel-2025.3-2","kayenta-2025.3-3","igor-2025.3-2","halyard-2025.3-6","gate-2025.3-2","front50-2025.3-2","fiat-2025.3-2","echo-2025.3-2","clouddriver-2025.3-5","bn-orca-release-2025.3.x-3","bn-keel-release-2025.3.x-2","bn-kayenta-release-2025.3.x-3","bn-igor-release-2025.3.x-2","bn-front50-release-2025.3.x-2","bn-fiat-release-2025.3.x-2","rosco-2025.4-3","orca-2025.4-4","keel-2025.4-2","kayenta-2025.4-4","igor-2025.4-2","halyard-2025.4-6","gate-2025.4-2","front50-2025.4-2","fiat-2025.4-2","echo-2025.4-2","clouddriver-2025.4-5","halyard-2025.3-5","clouddriver-2025.3-4","halyard-2025.4-5","clouddriver-2025.4-4","spinnaker-release-2025.3.1","deck-kayenta-2025.3.1","deck-2025.3.1","orca-2025.3-2","kayenta-2025.3-2","halyard-2025.3-4","clouddriver-2025.3-3","spinnaker-release-2025.4.1","deck-kayenta-2025.4.1","bn-deck-kayenta-release-2025.4.x-6","bn-deck-kayenta-release-2025.3.x-6","rosco-2025.3.1","orca-2025.3.1","keel-2025.3.1","kayenta-2025.3.1","igor-2025.3.1","halyard-2025.3.1","halyard-2025.3-3","gate-2025.3.1","front50-2025.3.1","fiat-2025.3.1","echo-2025.3.1","clouddriver-2025.3.1","clouddriver-2025.3-2","orca-2025.4-3","kayenta-2025.4-3","halyard-2025.4-4","deck-2025.4.1","clouddriver-2025.4-3","halyard-2025.4-3","clouddriver-2025.4-2","deck-2025.3-3","deck-2025.4-4","halyard-2025.4-2","clouddriver-2025.4.1","rosco-2025.3-1","orca-2025.3-1","keel-2025.3-1","kayenta-2025.3-1","igor-2025.3-1","halyard-2025.3-2","gate-2025.3-1","front50-2025.3-1","fiat-2025.3-1","echo-2025.3-1","halyard-2025.3-1","rosco-2025.4.1","rosco-2025.4-2","orca-2025.4.1","orca-2025.4-2","keel-2025.4.1","keel-2025.4-1","kayenta-2025.4.1","kayenta-2025.4-2","igor-2025.4.1","igor-2025.4-1","halyard-2025.4.1","halyard-2025.4-1","gate-2025.4.1","gate-2025.4-1","front50-2025.4.1","front50-2025.4-1","fiat-2025.4.1","fiat-2025.4-1","echo-2025.4.1","echo-2025.4-1","clouddriver-2025.4-1","spinnaker-release-2025.3.0","rosco-2025.3.0","orca-2025.3.0","keel-2025.3.0","kayenta-2025.3.0","igor-2025.3.0","halyard-2025.3.0","gate-2025.3.0","front50-2025.3.0","fiat-2025.3.0","echo-2025.3.0","deck-kayenta-2025.3.0","deck-2025.3.0","clouddriver-2025.3.0","bn-spin-release-2025.3.x-3","orca-2025.4-1","kayenta-2025.4-1","spinnaker-release-2025.4.0","rosco-main-30","rosco-2025.4.0","rosco-2025.4-1","orca-main-68","orca-2025.4.0","orca-2025.4-0","keel-main-31","keel-2025.4.0","keel-2025.4-0","kayenta-main-69","kayenta-2025.4.0","kayenta-2025.4-0","igor-main-36","igor-2025.4.0","igor-2025.4-0","halyard-main-65","halyard-2025.4.0","halyard-2025.4-0","gate-main-46","gate-2025.4.0","gate-2025.4-0","front50-main-34","front50-2025.4.0","front50-2025.4-0","fiat-main-30","fiat-2025.4.0","fiat-2025.4-0","echo-main-37","echo-2025.4.0","echo-2025.4-0","deck-kayenta-2025.4.0","deck-kayenta-2025.4-0","deck-2025.4.0","deck-2025.4-0","clouddriver-main-60","clouddriver-2025.4.0","clouddriver-2025.4-0","bn-spin-release-2025.4.x-0","rosco-2025.3-0","orca-main-65","orca-2025.3-0","keel-2025.3-0","kayenta-main-66","kayenta-2025.3-0","igor-2025.3-0","halyard-2025.3-0","gate-2025.3-0","front50-2025.3-0","fiat-2025.3-0","echo-2025.3-0","deck-kayenta-2025.3-0","deck-2025.3-0","clouddriver-2025.3-0","echo-main-34","orca-main-64","kayenta-main-65","orca-main-63","kayenta-main-64","orca-main-62","kayenta-main-63","orca-main-60","kayenta-main-61","orca-main-59","kayenta-main-60","halyard-main-62","gate-main-42","front50-main-31","halyard-main-61","clouddriver-main-57","orca-main-58","kayenta-main-59","gate-main-41","gate-main-40","orca-main-57","kayenta-main-58","halyard-main-60","clouddriver-main-56","orca-main-56","kayenta-main-57","rosco-main-27","orca-main-55","keel-main-28","kayenta-main-56","igor-main-33","halyard-main-59","gate-main-39","front50-main-30","fiat-main-27","echo-main-33","clouddriver-main-55","orca-main-54","kayenta-main-55","rosco-main-26","orca-main-53","keel-main-27","kayenta-main-54","igor-main-32","halyard-main-58","gate-main-38","front50-main-29","fiat-main-26","echo-main-32","clouddriver-main-54","gate-main-37","orca-main-52","kayenta-main-53","gate-main-36","orca-main-51","kayenta-main-52","orca-main-50","kayenta-main-51","orca-main-49","kayenta-main-50","orca-main-48","kayenta-main-49","orca-main-47","kayenta-main-48","gate-main-35","halyard-main-57","clouddriver-main-53","igor-main-31","orca-main-46","kayenta-main-47","orca-main-45","kayenta-main-46","halyard-main-56","clouddriver-main-52","orca-main-44","kayenta-main-45","halyard-main-55","clouddriver-main-51","orca-main-43","kayenta-main-44","halyard-main-54","clouddriver-main-50","orca-main-42","kayenta-main-43","halyard-main-53","front50-main-28","orca-main-41","kayenta-main-42","halyard-main-52","clouddriver-main-49","orca-main-40","keel-main-26","kayenta-main-41","igor-main-30","gate-main-34","front50-main-27","fiat-main-25","echo-main-31","gate-main-33","gate-main-32","spinnaker-release-2025.2.0","rosco-main-22","rosco-2025.2.0","rosco-2025.2-0","orca-main-36","orca-2025.2.0","orca-2025.2-0","keel-main-23","keel-2025.2.0","keel-2025.2-0","kayenta-main-37","kayenta-2025.2.0","kayenta-2025.2-0","igor-main-27","igor-2025.2.0","igor-2025.2-0","halyard-main-45","halyard-2025.2.0","halyard-2025.2-0","gate-main-29","gate-2025.2.0","gate-2025.2-0","front50-main-23","front50-2025.2.0","front50-2025.2-0","fiat-main-22","fiat-2025.2.0","fiat-2025.2-0","echo-main-28","echo-2025.2.0","echo-2025.2-0","deck-kayenta-2025.2.0","deck-kayenta-2025.2-0","deck-2025.2.0","deck-2025.2-0","clouddriver-main-43","clouddriver-2025.2.0","clouddriver-2025.2-0","bn-spin-release-2025.2.x-0","bn-rosco-release-2025.2.x-0","bn-keel-release-2025.2.x-0","bn-igor-release-2025.2.x-0","bn-front50-release-2025.2.x-0","bn-fiat-release-2025.2.x-0","halyard-main-50","front50-main-26","rosco-main-24","orca-main-39","keel-main-25","kayenta-main-40","igor-main-29","halyard-main-49","gate-main-31","front50-main-25","fiat-main-24","echo-main-30","clouddriver-main-47","halyard-main-48","clouddriver-main-46","orca-main-38","kayenta-main-39","halyard-main-47","clouddriver-main-45","rosco-main-23","orca-main-37","keel-main-24","kayenta-main-38","igor-main-28","halyard-main-46","gate-main-30","front50-main-24","fiat-main-23","echo-main-29","clouddriver-main-44","gate-main-28","halyard-main-44","clouddriver-main-42","halyard-main-43","clouddriver-main-41","halyard-main-42","clouddriver-main-40","halyard-main-41","clouddriver-main-39","halyard-main-40","clouddriver-main-38","halyard-main-39","halyard-main-38","clouddriver-main-37","rosco-main-21","orca-main-35","keel-main-22","kayenta-main-36","igor-main-26","halyard-main-37","gate-main-27","front50-main-22","fiat-main-21","echo-main-27","clouddriver-main-36","gate-main-26","rosco-main-20","orca-main-34","keel-main-21","kayenta-main-35","igor-main-25","halyard-main-36","gate-main-25","front50-main-21","fiat-main-20","echo-main-26","clouddriver-main-35","halyard-main-35","clouddriver-main-34","echo-main-25","halyard-main-34","halyard-main-33","clouddriver-main-33","orca-main-33","kayenta-main-34","rosco-2025.1.0","rosco-2025.1-0","orca-main-32","orca-2025.1.0","orca-2025.1-0","keel-2025.1.0","keel-2025.1-0","kayenta-main-33","kayenta-2025.1.0","kayenta-2025.1-0","igor-2025.1.0","igor-2025.1-0","halyard-2025.1.0","halyard-2025.1-0","gate-2025.1.0","gate-2025.1-0","front50-2025.1.0","front50-2025.1-0","fiat-2025.1.0","fiat-2025.1-0","echo-2025.1.0","echo-2025.1-0","deck-kayenta-2025.1.0","deck-kayenta-2025.1-0","deck-2025.1.0","deck-2025.1-0","clouddriver-2025.1.0","clouddriver-2025.1-0","bn-spin-release-2025.1.x-0","bn-deck-release-2025.1.x-0","bn-deck-kayenta-release-2025.1.x-0","rosco-main-19","orca-main-31","keel-main-20","kayenta-main-32","igor-main-24","halyard-main-32","gate-main-24","front50-main-20","fiat-main-19","echo-main-24","clouddriver-main-32","rosco-main-18","orca-main-30","keel-main-19","kayenta-main-31","igor-main-23","halyard-main-31","gate-main-23","front50-main-19","fiat-main-18","echo-main-23","clouddriver-main-31","gate-main-22","kayenta-main-30","halyard-main-30","clouddriver-main-30","orca-main-28","kayenta-main-29","halyard-main-29","clouddriver-main-29","keel-main-18","halyard-main-28","clouddriver-main-28","halyard-main-27","clouddriver-main-27","rosco-main-17","orca-main-27","keel-main-17","kayenta-main-28","igor-main-22","halyard-main-26","gate-main-21","front50-main-18","fiat-main-17","echo-main-22","clouddriver-main-26","orca-main-26","kayenta-main-27","halyard-main-25","clouddriver-main-25","orca-main-25","kayenta-main-26","orca-main-24","kayenta-main-25","echo-main-21","orca-main-23","kayenta-main-24","orca-main-22","kayenta-main-23","orca-main-21","kayenta-main-22","orca-main-20","kayenta-main-21","halyard-main-24","clouddriver-main-24","rosco-main-16","orca-main-19","keel-main-16","kayenta-main-20","igor-main-21","halyard-main-23","gate-main-20","front50-main-17","fiat-main-16","echo-main-20","clouddriver-main-23","orca-main-18","kayenta-main-19","echo-main-19","rosco-main-15","orca-main-17","keel-main-15","kayenta-main-18","igor-main-20","halyard-main-22","gate-main-19","front50-main-16","fiat-main-15","echo-main-18","clouddriver-main-22","rosco-main-14","orca-main-16","keel-main-14","kayenta-main-17","igor-main-19","halyard-main-21","gate-main-18","front50-main-15","fiat-main-14","echo-main-17","clouddriver-main-21","orca-main-15","keel-main-13","kayenta-main-16","igor-main-18","halyard-main-20","gate-main-17","front50-main-14","fiat-main-13","echo-main-16","clouddriver-main-20","halyard-main-19","clouddriver-main-19","igor-main-17","gate-main-16","echo-main-15","halyard-main-18","clouddriver-main-18","rosco-main-12","orca-main-14","keel-main-12","kayenta-main-15","igor-main-16","halyard-main-17","gate-main-15","front50-main-13","fiat-main-12","echo-main-14","clouddriver-main-17","rosco-main-11","orca-main-13","keel-main-11","kayenta-main-14","igor-main-15","halyard-main-16","gate-main-14","front50-main-12","fiat-main-11","echo-main-13","clouddriver-main-16","rosco-main-10","orca-main-12","keel-main-10","kayenta-main-13","igor-main-14","halyard-main-15","gate-main-13","front50-main-11","fiat-main-10","echo-main-12","clouddriver-main-15","halyard-main-14","front50-main-10","gate-main-12","gate-main-11","orca-main-11","kayenta-main-12","gate-main-10","halyard-main-13","clouddriver-main-14","rosco-main-9","orca-main-10","keel-main-9","kayenta-main-11","igor-main-13","halyard-main-12","gate-main-9","front50-main-9","fiat-main-9","echo-main-11","clouddriver-main-13","igor-main-12","rosco-main-8","orca-main-9","keel-main-8","kayenta-main-10","igor-main-11","halyard-main-11","gate-main-8","front50-main-8","fiat-main-8","echo-main-10","clouddriver-main-12","igor-main-10","halyard-main-10","clouddriver-main-11","kayenta-main-9","clouddriver-main-10","rosco-main-6","orca-main-7","keel-main-6","kayenta-main-7","igor-main-8","halyard-main-8","gate-main-6","front50-main-6","fiat-main-6","echo-main-8","clouddriver-main-9","orca-main-6","kayenta-main-6","rosco-main-5","orca-main-5","keel-main-5","kayenta-main-5","halyard-main-7","gate-main-5","front50-main-5","fiat-main-5","echo-main-7","clouddriver-main-8","igor-main-6","halyard-main-6","clouddriver-main-7","rosco-main-4","orca-main-4","keel-main-4","kayenta-main-4","igor-main-5","halyard-main-5","gate-main-4","front50-main-4","fiat-main-4","echo-main-6","clouddriver-main-6","igor-main-4","halyard-main-4","echo-main-5","deck-main-2","deck-kayenta-main-2","bn-deck-kayenta-main-2","rosco-2025.0-0","orca-2025.0-0","keel-2025.0-0","kayenta-2025.0-0","igor-2025.0-0","halyard-2025.0-0","gate-2025.0-0","front50-2025.0-0","fiat-2025.0-0","echo-main-4","echo-2025.0-0","clouddriver-2025.0-0","bn-spin-release-2025.0.x-0","bn-deck-release-2025.0.x-0","bn-deck-kayenta-release-2025.0.x-0","rosco-main-3","orca-main-3","keel-main-3","kayenta-main-3","igor-main-3","halyard-main-3","gate-main-3","front50-main-3","fiat-main-3","echo-main-3","clouddriver-main-5","rosco-main-2","orca-main-2","keel-main-2","kayenta-main-2","igor-main-2","halyard-main-2","gate-main-2","front50-main-2","fiat-main-2","echo-main-2","clouddriver-main-4","spinnaker-release-2024.0.0","rosco-main-1","orca-main-1","keel-main-1","kayenta-main-1","igor-main-1","halyard-main-1","gate-main-1","front50-main-1","fiat-main-1","echo-main-1","clouddriver-main-3","clouddriver-main-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32613.json","vanir_signatures_modified":"2026-07-17T07:03:24Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactCredentials.java","function":"GitRepoArtifactCredentials"},"deprecated":false,"digest":{"function_hash":"7729238453547684480961891590321363323","length":147},"id":"CVE-2026-32613-09161daa","signature_type":"Function"},{"deprecated":false,"digest":{"length":918,"function_hash":"298506883166373794577067824980824917152"},"id":"CVE-2026-32613-0addf9bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitJobExecutor.java","function":"cloneOrPull"}},{"source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactConfiguration.java"},"deprecated":false,"digest":{"line_hashes":["5497621926061787614681920255342698180","340182982242265501209165007809709498885","103958968029950381931537152082746606173","334828506433135861874979942180694854228"],"threshold":0.9},"id":"CVE-2026-32613-45a3a0ff","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"echo/echo-pipelinetriggers/src/main/java/com/netflix/spinnaker/echo/pipelinetriggers/postprocessors/ExpectedArtifactExpressionEvaluationPostProcessor.java","function":"ExpectedArtifactExpressionEvaluationPostProcessor"},"deprecated":false,"digest":{"function_hash":"139155116847106757566973004891377427557","length":211},"id":"CVE-2026-32613-5090e414"},{"digest":{"line_hashes":["285719613654536594515574142172075184476","95077355848200363260943745551223085933","93827171729651818667437964459134625516","266094873682205093329859793737959919523","61616895900810301429579076289658391877","102095739902009433608497712183897697842","24363232535463917638490110081635767054","16833512841035586199130682589656892023","191986408303099052361022060107710126984","319017498140550577425748641303659171482","32380904515518074939743751639010693491","304091423959167035641271207415393609001","127760597369858620860875516595457630071","3280036126308676168482752715324533424","237456636875732689868373568496676943934","269983543879194016042111019760288139676","72231749768016330242257575355308892801"],"threshold":0.9},"id":"CVE-2026-32613-60c2cc3e","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactAccount.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactCredentials.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["53700598082466798908033504492642884154","215138800868894405310664986984636672133","141546563977676825682565619881894203658","63637559197929177631188945664125188919","138784393859536885108088900695333153092","36988513984363266069341883924742772296","33734825849021711635258359805618302978","154556100886931773789767590121809410041","4047351630023712816433146811753967957","238765742327084271711491416086752438128","195865322894186241038198901339685785031","6984440627401942935603300271229308052","114774787095804630982185305720455163794","339778759899333977499781191526438505048","236764516583661535331838352444664674854","40989921020998704080299698674255697575","199260232173592011441436549866498273941","146615497247996641198800686443434222204","87538565372074563780445996090326431068","316581709663333566796806135934747286104","133103685644011959070593792083994144286","88567468907249837177416710463029452084","224875877772954140826831896151133659934","14013044793438059072873736497670039367"]},"id":"CVE-2026-32613-68ee04b5"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"function":"download","file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactCredentials.java"},"deprecated":false,"digest":{"function_hash":"151890429271056851550724553964224811391","length":532},"id":"CVE-2026-32613-6dd63325"},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"echo/echo-pipelinetriggers/src/main/java/com/netflix/spinnaker/echo/pipelinetriggers/postprocessors/ExpectedArtifactExpressionEvaluationPostProcessor.java","function":"processPipeline"},"deprecated":false,"digest":{"function_hash":"302869976012310252707219660030328517620","length":594},"id":"CVE-2026-32613-89ea4c15","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"170978062883409652252248118056420669782","length":322},"id":"CVE-2026-32613-de6c2a81","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitJobExecutor.java","function":"archive"}},{"deprecated":false,"digest":{"line_hashes":["104759193315833268533051595394108699950","213657116434803905697664728884484372426","263770928682265681518359990128134800877","158686011840976768594999089226510659950","175786443223357585946388776042986410251","222249307309012435446502053110133651578","295658091764350258405849947822463284841","252711348614625083017287062819923584420","184343467897905078977366020907009558304","92185615237534023204951336273613920363","136167686550555654140779130885299822983","27923095991815526588399609791860118993","289295033717594432545858787930552335460","285586309385991461317051391481000489689","10885785054384653084200431194238315566","263298556189026497758521296193847364424","18990204868522107119900653774088069850","275441304944045186378763338827685182552","70933056620924313409026497914504768419","316236857124252684516333297484098530939","152805939706617308018808017651177053005","63572163356618238985630280364217410971"],"threshold":0.9},"id":"CVE-2026-32613-e65be06c","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"echo/echo-pipelinetriggers/src/main/java/com/netflix/spinnaker/echo/pipelinetriggers/postprocessors/ExpectedArtifactExpressionEvaluationPostProcessor.java"}},{"digest":{"function_hash":"200174727083935994597756181867925650858","length":639},"id":"CVE-2026-32613-e8704563","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactAccount.java","function":"GitRepoArtifactAccount"},"deprecated":false},{"source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitJobExecutor.java"},"deprecated":false,"digest":{"line_hashes":["113841194868219201802325554001121448478","17826257160454724540353631166307172290","152076201362382341571773302502199513533","297522376512842471950736362083851666700","302965313114943976682957369077681754984","193574060178935607522263213933840371515","338648036141811586042792350312696586505","309063972870286961736417278701202386641","218499363905484864415412165289084046070","72381255312436400157996296813244629310","271397213442670050686075869650224461590","166587389687949307114255401466617864725","101526005138619413336192256248011769715","213987736454854133032224414160210441975","242616473467799770610964090071846076309","9370314403759255774914457737376628097","268184068276536869588461449563137945214","16531029899114726043184467545088373259","305945692589769636345565571745200813284","205109281613136104258724329850690948311"],"threshold":0.9},"id":"CVE-2026-32613-f737ae30","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa","target":{"function":"gitCredentialsProperties","file":"clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactConfiguration.java"},"deprecated":false,"digest":{"function_hash":"20564213726775893638325955562671798803","length":580},"id":"CVE-2026-32613-fb5d91d8","signature_type":"Function"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}