| Package | Affected versions | Patched versions |
|---|---|---|
| io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo | < 2026.0.1 | 2026.0.1 |
| spinnaker | ≥ 2025.4.0, < 2025.4.2≥ 2026.0.0, < 2026.0.1< 2025.3.2 | 2025.4.22026.0.12025.3.2 |
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free