{"id":"GHSA-x3j7-7pgj-h87r","summary":"Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths","details":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.","aliases":["CVE-2026-32604"],"modified":"2026-09-10T03:51:03.862828310Z","published":"2026-04-21T14:48:38Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-21T14:48:38Z","nvd_published_at":"2026-04-20T21:16:32Z","cwe_ids":["CWE-20"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32604"},{"type":"PACKAGE","url":"https://github.com/spinnaker/spinnaker"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2"},{"type":"WEB","url":"https://zeropath.com/blog/spinnaker-rce-production-compromise"}],"affected":[{"package":{"name":"io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.clouddriver/clouddriver-artifacts-gitrepo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.0.1"}]}],"versions":["2026.0-0","2026.0-1","2026.0-10","2026.0-11","2026.0-12","2026.0-13","2026.0-14","2026.0-15","2026.0-16","2026.0-17","2026.0-18","2026.0-19","2026.0-2","2026.0-20","2026.0-21","2026.0-22","2026.0-23","2026.0-3","2026.0-4","2026.0-5","2026.0-6","2026.0-7","2026.0-8","2026.0-9","2026.0.0","main-132","main-133","main-134","main-135","main-136","main-137","main-139","main-140","main-141","main-142","main-143","main-144","main-145","main-146","main-147","main-148","main-149","main-150","main-151","main-152","main-153","main-154","main-155","main-156","main-157","main-158","main-159","main-160","main-161","main-162","main-163","main-164","main-165","main-166","main-167","main-168","main-169","main-170","main-171","main-172","main-173","main-174","main-175","main-176","main-177","main-178","main-179","main-180","main-181","main-182","main-183","main-184","main-185","main-186","main-187","main-188","main-189","main-190","main-191","main-192","main-193","main-194","main-195","main-196","main-197","main-198","main-199","main-200","main-201","main-202","main-203","main-204","main-205","main-206","main-207","main-208","main-209","main-210","main-211","main-212","main-213","main-214","main-215","main-216","main-217","main-218","main-219","main-220","main-222","main-223","main-224","main-225","main-226","main-227","main-228","main-229","main-230","main-231","main-232","main-233","main-234","main-235","main-236","main-237","main-239","main-241","main-272","main-273","main-274","main-275","main-276","main-277","main-278","main-279","main-280","main-281","main-282","main-283","main-284","main-285","main-286","main-287","main-288","main-289","main-290","main-291","main-292","main-293","main-294","main-295","main-296","main-297","main-298","main-299","main-300","main-301","main-302","main-303","main-304","main-305","main-306","main-307","main-308","main-309","main-310","main-311","main-312","main-313","main-314","main-315","main-316","main-317","main-318","main-319","main-320","main-321","main-322","main-323","main-324","main-325","main-326","main-327","main-328","main-329","main-330","main-331","main-332","main-333","main-334","main-335","main-336","main-337"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-x3j7-7pgj-h87r/GHSA-x3j7-7pgj-h87r.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}