CVE-2026-32613 json
Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
published 2026-04-20 6 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-23964 , GHSA-69rw-45wj-g4v6
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
Patch / fix
- maven io.spinnaker.echo:echo-pipelinetriggers 2025.3.2, 2025.4.2, 2026.0.1
- io.spinnaker.echo echo-pipelinetriggers 2025.3.2, 2025.4.2, 2026.0.1
- linuxfoundation spinnaker 2025.3.2, 2025.4.2, 2026.0.1
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2 release
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2 release
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1 release
- github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.spinnaker.echo:echo-pipelinetriggers | >=2026.0-0, <2026.0.1 >=2025.4-0, <2025.4.2 <2025.3.2 |
2026.0.1 2025.4.2 2025.3.2 |
Affected products
- spinnaker spinnaker
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6
web, mitigation, vendor-advisory
-
github.com
/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
web, product, release-notes
-
github.com
/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
web, product, release-notes
-
github.com
/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
web, product, release-notes
-
zeropath.com
/blog/spinnaker-rce-production-compromise
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32613
advisory
-
github.com
/spinnaker/spinnaker
package
-
github.com
/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2
web
Sources
- CVE List CVE-2026-32613
- GitHub Advisory GHSA-69rw-45wj-g4v6
- NVD CVE-2026-32613
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.