Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9MavenPublished

    Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

    CVE-2026-32604 · GHSA-x3j7-7pgj-h87r

    Affected
    • Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo < 2026.0.1
    Fixed in
    2026.0.1· Vendor fix available
    Issue
    Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

    Recommended action: Upgrade to 2026.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →