Spinnaker vulnerable a SSRF debido a restricciones inadecuadas en http de la entrada del usuario

The core impact of CVE-2025-61916 lies in the ability to trigger arbitrary HTTP requests from the Spinnaker server. An attacker can leverage this SSRF vulnerability to fetch data from remote URLs and inject it into Spinnaker pipelines, particularly through the use of Helm or other artifact types. This can lead to the exposure of sensitive information, such as idmsv1 authentication data, and the ability to call internal Spinnaker APIs. Furthermore, depending on the artifact configuration, authentication headers (e.g., GitHub authentication tokens) may be exposed to external endpoints, resulting in credential theft. The blast radius extends to any system accessible via the remote URL, potentially including internal services and external APIs.

Organizations utilizing Spinnaker for continuous delivery pipelines, particularly those relying on GitHub file artifacts or other artifact types that allow user input, are at risk. Environments with permissive network configurations or inadequate access controls are especially vulnerable. Shared hosting environments where multiple users share a Spinnaker instance should also be considered at higher risk.

• linux / server:

journalctl -u spinnaker -g "outbound request"

• generic web:

curl -I <spinnaker_server_ip>/artifacts/some_artifact | grep -i 'Host:'

1. 2026-01-05Disclosure

   disclosure

1. Reservado2025-10-03
2. Publicada2026-01-05
3. Modificada2026-04-02
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-61916 is to upgrade Spinnaker Clouddriver Artifacts to version 2025.1.6 or later. Prior to upgrading, carefully review the release notes for any breaking changes that may impact existing pipelines or configurations. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the Spinnaker server to only trusted domains. Web Application Firewalls (WAFs) can be configured to block suspicious outbound requests, particularly those targeting internal or sensitive endpoints. Monitor Spinnaker logs for unusual outbound HTTP requests that may indicate exploitation attempts.