Vulnerability record · CVE-2026-32604 · published 20 April 2026

CVE-2026-32604: Linuxfoundation spinnaker improper input validation vulnerability

Linuxfoundation · Spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

9.9 CVSS 3.1 Critical EPSS 0.77% · top 46.3% CWE-20 · Improper input validation

9.9CVSS 3.1 base score

0.77%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Spinnaker Linuxfoundation

References

Link	Tags
https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2	ProductRelease Notes
https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2	ProductRelease Notes
https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1	ProductRelease Notes
https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r	MitigationVendor Advisory
https://zeropath.com/blog/spinnaker-rce-production-compromise

Track CVE-2026-32604 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-32613Linuxfoundation spinnaker code injection vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to proce…EPSS 0.66%20 Apr 2026 9.8CVE-2021-43832Linuxfoundation spinnaker missing authentication for critical function vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. Thi…EPSS 2.6%4 Jan 2022 8.8CVE-2026-44795Linuxfoundation spinnaker deserialization of untrusted data vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing by…EPSS 1.0%10 Jul 2026 8.8CVE-2020-9301Linuxfoundation spinnaker deserialization of untrusted data vulnerabilityNolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. T…EPSS 1.5%11 Dec 2020 7.5CVE-2026-55175Linuxfoundation spinnaker deserialization of untrusted data vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respecti…EPSS 1.1%10 Jul 2026 7.5CVE-2022-23506Linuxfoundation spinnaker sensitive information in log file vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces mac…EPSS 0.54%3 Jan 2023 7.1CVE-2021-39143Linuxfoundation spinnaker path traversal vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngin…EPSS 0.34%4 Jan 2022 6.6CVE-2025-61916Linuxfoundation spinnaker improper input validation vulnerabilitySpinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-si…EPSS 0.17%5 Jan 2026

Source: NIST National Vulnerability Database (record CVE-2026-32604), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.