CVE-2026-25534: Spinnaker clouddriver and orca URL Validation Bypass via Underscores in Hostnames
Summary
CVE-2026-25534: Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames. Affects io.spinnaker.clouddriver:clouddriver-artifacts across 3 version ranges.
< 2025.2.4
>= 2025.3.0, < 2025.3.1
>= 2025.4.0, < 2025.4.1
Fixed in 2025.2.4, 2025.3.1 or 2025.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spinnaker is an open-source, multi-cloud continuous delivery platform that helps developers release software changes with high velocity and confidence. It integrates with various cloud providers and offers features like deployment pipelines, monitoring, and scaling. The clouddriver and orca components are essential for managing cloud resources and orchestrating deployment processes. However, a recent vulnerability has been identified in the URL validation logic of these components, which could lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from a flaw in the URL validation logic implemented in Spinnaker's clouddriver and orca components. Specifically, Java URL objects do not handle underscores correctly during parsing, allowing attackers to craft malicious URLs that bypass the intended validation checks. This issue not only affects the clouddriver but also the orca component, leading to potential exploitation of the system. The severity of this vulnerability is classified as critical, with a CVSS score of 9.1, indicating a high risk of impact on confidentiality, integrity, and availability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2025.2.42025.2.4 -
>= 2025.3.0, < 2025.3.12025.3.1 -
>= 2025.4.0, < 2025.4.12025.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the affected artifacts in your Spinnaker setup to mitigate the risk associated with this vulnerability until you can apply the necessary updates.
Conclusion
The CVE-2026-25534 vulnerability poses a significant risk to users of Spinnaker's clouddriver and orca components due to improper URL validation. It is crucial to apply the recommended patches or workarounds to protect your application from potential exploitation.
See every vulnerability recorded for io.spinnaker.clouddriver:clouddriver-artifacts →
FAQ
CVE-2026-25534 is a critical vulnerability in Spinnaker's clouddriver and orca components that allows URL validation bypass through the use of underscores in hostnames.
This vulnerability could allow attackers to exploit your application by crafting malicious URLs that bypass security checks, potentially leading to unauthorized access or data exposure.
If you are using an affected version of clouddriver or orca, you should update to the patched versions (2025.4.1, 2025.3.1, 2025.2.4, or 2026.0.0) as soon as possible.
Yes, you can temporarily disable the affected artifacts in your Spinnaker setup to mitigate the risk until you can apply the updates.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the pom.xml file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.spinnaker.clouddriver:clouddriver-artifacts.
