Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Impact
Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result.
Patches
This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.
Workarounds
You can disable the various artifacts on this system to work around these limits.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.spinnaker.clouddriver:clouddriver-artifacts | >= 2025.1.6, < 2025.2.4, >= 2025.3.0, < 2025.3.1, >= 2025.4.0, < 2025.4.1 | 2025.2.4, 2025.3.1, 2025.4.1 |
| Java / Kotlin (Maven) | io.spinnaker.orca:orca-core | >= 2025.1.6, < 2025.2.4, >= 2025.3.0, < 2025.3.1, >= 2025.4.0, < 2025.4.1 | 2025.2.4, 2025.3.1, 2025.4.1 |
References
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h
- https://nvd.nist.gov/vuln/detail/CVE-2026-25534
- https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
- https://github.com/spinnaker/spinnaker
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L- Weakness (CWE)
CWE-918- Platform
- Java / Kotlin (Maven)
- Package
io.spinnaker.clouddriver:clouddriver-artifacts, io.spinnaker.orca:orca-core- Disclosed
- 16.03.2026
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8r8j-gfhg-fw38 - CC BY 4.0
Vulnerability history: io.spinnaker.orca:orca-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 03.2026 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
Disclosures per year
- 2026: 2
-
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.