CVE-2026-32604 Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Attackers can execute arbitrary commands on Spinnaker clouddriver pods via unsanitized gitrepo artifact inputs, exposing credentials and modifying resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32604?
CVE-2026-32604 is a critical command injection vulnerability in spinnaker, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.
Weakness: CWE-20
Which versions are affected by CVE-2026-32604?
2 open source packages ship an affected version, including io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo Maven | All versions | 2026.0.1 |
io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo Maven | All versions | 2026.0.1 |
Products include Linuxfoundation Spinnaker.
How do I fix CVE-2026-32604?
Upgrade io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo to 2026.0.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-32604 being exploited?
There is no known exploitation of CVE-2026-32604 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in spinnaker
- CVE-2026-32613 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
- CVE-2021-43832 Improper Access Control in spinnaker
- CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
- CVE-2020-9301 Code injection in Netflix Spinnaker
- CVE-2025-61916 Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
Sources
Also known as GHSA-x3j7-7pgj-h87r.