QwikSec

Security Database

CVE

CWE

Training

CVE-2026-32604

Published: Apr 20, 2026

Modified: Apr 23, 2026

PUBLISHED

CVSS v3.1

10.0

CRITICAL

Description

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

Vendor	Product	Versions
spinnaker	spinnaker	affected `< 2026.0.1` affected `< 2025.4.2` affected `< 2025.3.2` affected `< 2026.1.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r

x_refsource_CONFIRM

https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2

x_refsource_MISC

https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2

x_refsource_MISC

https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.