CVE-2026-25534 - Vulnerability Analysis

Overview

Spinnaker < 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0 contains a validation bypass caused by improper handling of underscores in Java URL parsing in clouddriver and Orca fromUrl expression, letting attackers bypass URL validation, exploit requires crafted URLs.

Severity & Score

Impact

Attackers can bypass URL validation, potentially leading to unauthorized actions or security bypasses in affected components.

Mitigation

Update to versions 2025.4.1, 2025.3.1, 2025.2.4, 2026.0.0 or later.

References

• https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 18, 2026

🚨 CRITICAL: CVE-2026-25534 SSRF in Spinnaker clouddriver-artifacts. Versions <2025.2.4 & select 2025.x allow SSRF via URL validation bypass. Patch to 2025.2.4+, 2025.3.1, 2025.4.1, or 2026.0.0 ASAP! Details: https://radar.offseq.com/threat/cve-2026-25534-cwe-918-server-side-request-forgery-618622b4 #OffSeq #SSRF #Spinnaker

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner