What is the CVSS score of CVE-2026-25534?

CVE-2026-25534 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-25534?

A critical vulnerability in Spinnaker (CVE-2026-25534, CVSS 9.1) allows attackers to bypass URL validation controls in both Clouddriver and Orca components through specially crafted URLs, potentially…. A patch is available.

How to fix or mitigate CVE-2026-25534?

Within 24 hours: Audit current Spinnaker version and determine if you are running affected versions (pre-2025.4.1, pre-2025.3.1, pre-2025.2.4, or pre-2026.0.0). Within 7 days: Apply the available vendor patch to upgrade to patched versions. If patching cannot be completed immediately, implement compensating controls by disabling artifact handling in Orca fromUrl expression evaluation until patching is completed. Within 30 days: Complete full deployment of patched versions across all Spinnaker instances and conduct a security review of artifact sources to identify any potential compromise.

Java CVE-2026-25534

CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-16 https://github.com/spinnaker/spinnaker

GHSA-8r8j-gfhg-fw38

SSRF Java

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Mar 16, 2026 - 16:00 vuln.today

Patch released

Mar 16, 2026 - 16:00 nvd

Patch available

CVE Published

Mar 16, 2026 - 15:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Impact

Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result.

Patches

This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.

Workarounds

You can disable the various artifacts on this system to work around these limits.

AnalysisAI

Java URL parsing in Spinnaker's clouddriver and Orca components fails to properly validate URLs containing underscores, allowing authenticated attackers to bypass URL sanitation controls and potentially execute arbitrary code or access unauthorized resources. This vulnerability affects both the clouddriver artifact handling and Orca fromUrl expression evaluation in versions prior to 2025.2.4, 2025.3.1, 2025.4.1, and 2026.0.0. Patched versions are available, and affected deployments can temporarily disable the vulnerable components as a workaround.

Technical ContextAI

The vulnerability affects Spinnaker's clouddriver-artifacts and orca-core components (identified via CPE as pkg:maven/io.spinnaker.clouddriver:clouddriver-artifacts and pkg:maven/io.spinnaker.orca:orca-core) which handle URL validation for user-supplied input. The root cause stems from CWE-918 (Server-Side Request Forgery), where Java's URL parsing logic incorrectly processes underscores, creating a gap in the validation mechanism. This implementation flaw specifically impacts the artifact handling functionality in both clouddriver and orca's fromUrl expression processing, allowing malicious actors to construct URLs that appear valid to the flawed validation logic but actually target unintended destinations.

RemediationAI

Immediately upgrade Spinnaker to versions 2025.4.1, 2025.3.1, 2025.2.4, or 2026.0.0 or later, which contain the fix documented in commit 7c4737906239a958a468e843239c6785b03d0eda. If immediate patching is not possible, disable artifact functionality in the affected systems as a temporary workaround, though this may impact operational capabilities. Review the vendor advisories at https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38 and monitor https://github.com/advisories/GHSA-8r8j-gfhg-fw38 for additional updates.