Spinnaker clouddriver und orca URL-Validierungs-Bypass über Unterstriche in Hostnamen

This URL bypass vulnerability allows attackers to craft malicious URLs that bypass Spinnaker's intended URL validation mechanisms. Successful exploitation could lead to arbitrary code execution within the Spinnaker environment, granting an attacker significant control over the affected system. The impact extends beyond just the artifacts component, as the underlying URL parsing issue affects Orca’s fromUrl expression handling as well. This means an attacker could potentially manipulate deployments or other critical Spinnaker operations by injecting malicious code through crafted URLs. The blast radius is significant, potentially impacting all pipelines and deployments managed by Spinnaker.

Organizations heavily reliant on Spinnaker for continuous delivery pipelines are at significant risk. Specifically, those using older versions of Spinnaker (≤main-99) and those with custom fromUrl expressions in Orca are particularly vulnerable. Shared hosting environments utilizing Spinnaker also face increased risk due to potential cross-tenant exploitation.

• linux / server:

journalctl -u spinnaker-clouddriver -g 'URL validation' | grep -i underscore

• generic web:

curl -I <spinnaker_url>/artifacts/ | grep 'Content-Type:'

• generic web:

 grep -i 'underscore' /var/log/nginx/access.log

1. 2026-03-16Disclosure

   disclosure

1. Reserviert2026-02-02
2. Veröffentlicht2026-03-16
3. Geändert2026-04-02
4. EPSS aktualisiert2026-03-25

The primary mitigation for CVE-2026-25534 is to upgrade Spinnaker Clouddriver Artifacts to version 2025.2.4 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing stricter URL filtering rules at the proxy or WAF level to block URLs containing suspicious characters or patterns. Specifically, look for URLs containing underscores in unexpected locations. Review and audit existing fromUrl expressions in Orca to identify and sanitize any potentially vulnerable configurations. After upgrading, confirm the fix by attempting to inject a crafted URL (e.g., http://example.com/_evil) and verifying that it is properly blocked or sanitized.