Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.spinnaker.echo:echo-pipelinetriggers

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9MavenPublished

    Spinnaker: RCE via expression parsing due to unrestricted context handling

    CVE-2026-32613 · GHSA-69rw-45wj-g4v6

    Affected
    • Maven io.spinnaker.echo:echo-pipelinetriggers >= 2026.0-0, < 2026.0.1; >= 2025.4-0, < 2025.4.2; < 2025.3.2
    Fixed in
    2026.0.12025.3.22025.4.2· Vendor fix available
    Issue
    Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.

    Recommended action: Upgrade to 2026.0.1, 2025.4.2 or 2025.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →