Spinnaker: RCE via expression parsing due to unrestricted context handling
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.spinnaker.echo:echo-pipelinetriggers | >= 2026.0-0, < 2026.0.1, >= 2025.4-0, < 2025.4.2, < 2025.3.2 | 2026.0.1, 2025.4.2, 2025.3.2 |
References
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6
- https://nvd.nist.gov/vuln/detail/CVE-2026-32613
- https://github.com/spinnaker/spinnaker
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.2
- https://zeropath.com/blog/spinnaker-rce-production-compromise
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-94- Platform
- Java / Kotlin (Maven)
- Package
io.spinnaker.echo:echo-pipelinetriggers- Disclosed
- 21.04.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-69rw-45wj-g4v6 - CC BY 4.0
Vulnerability history: io.spinnaker.echo:echo-pipelinetriggers
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.