CVE-2026-32613
- Source
- https://cve.org/CVERecord?id=CVE-2026-32613
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32613.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-32613
- Aliases
- Published
- 2026-04-20T20:07:24.697Z
- Modified
- 2026-07-17T07:03:24.488992Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
- Details
-
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
- Database specific
{ "cwe_ids": [ "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32613.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2
- https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32613.json
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6
- https://nvd.nist.gov/vuln/detail/CVE-2026-32613
- https://zeropath.com/blog/spinnaker-rce-production-compromise
Affected packages
Git / github.com/spinnaker/spinnaker
Affected ranges
- Type
- GIT
- Repo
- https://github.com/spinnaker/spinnaker
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "cpe": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "2025.3.2" }, { "introduced": "2025.4.0" }, { "fixed": "2025.4.2" }, { "introduced": "2026.0.0" }, { "fixed": "2026.0.1" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
Other
bn-deck-kayenta-main-2
clouddriver-main-10
clouddriver-main-11
clouddriver-main-12
clouddriver-main-13
clouddriver-main-14
clouddriver-main-15
clouddriver-main-16
clouddriver-main-17
clouddriver-main-18
clouddriver-main-19
clouddriver-main-2
clouddriver-main-20
clouddriver-main-21
clouddriver-main-22
clouddriver-main-23
clouddriver-main-24
clouddriver-main-25
clouddriver-main-26
clouddriver-main-27
clouddriver-main-28
clouddriver-main-29
clouddriver-main-3
clouddriver-main-30
clouddriver-main-31
clouddriver-main-32
clouddriver-main-33
clouddriver-main-34
clouddriver-main-35
clouddriver-main-36
clouddriver-main-37
clouddriver-main-38
clouddriver-main-39
clouddriver-main-4
clouddriver-main-40
clouddriver-main-41
clouddriver-main-42
clouddriver-main-43
clouddriver-main-44
clouddriver-main-45
clouddriver-main-46
clouddriver-main-47
clouddriver-main-49
clouddriver-main-5
clouddriver-main-50
clouddriver-main-51
clouddriver-main-52
clouddriver-main-53
clouddriver-main-54
clouddriver-main-55
clouddriver-main-56
clouddriver-main-57
clouddriver-main-6
clouddriver-main-60
clouddriver-main-7
clouddriver-main-8
clouddriver-main-9
deck-kayenta-main-2
deck-main-2
echo-main-1
echo-main-10
echo-main-11
echo-main-12
echo-main-13
echo-main-14
echo-main-15
echo-main-16
echo-main-17
echo-main-18
echo-main-19
echo-main-2
echo-main-20
echo-main-21
echo-main-22
echo-main-23
echo-main-24
echo-main-25
echo-main-26
echo-main-27
echo-main-28
echo-main-29
echo-main-3
echo-main-30
echo-main-31
echo-main-32
echo-main-33
echo-main-34
echo-main-37
echo-main-4
echo-main-5
echo-main-6
echo-main-7
echo-main-8
fiat-main-1
fiat-main-10
fiat-main-11
fiat-main-12
fiat-main-13
fiat-main-14
fiat-main-15
fiat-main-16
fiat-main-17
fiat-main-18
fiat-main-19
fiat-main-2
fiat-main-20
fiat-main-21
fiat-main-22
fiat-main-23
fiat-main-24
fiat-main-25
fiat-main-26
fiat-main-27
fiat-main-3
fiat-main-30
fiat-main-4
fiat-main-5
fiat-main-6
fiat-main-8
fiat-main-9
front50-main-1
front50-main-10
front50-main-11
front50-main-12
front50-main-13
front50-main-14
front50-main-15
front50-main-16
front50-main-17
front50-main-18
front50-main-19
front50-main-2
front50-main-20
front50-main-21
front50-main-22
front50-main-23
front50-main-24
front50-main-25
front50-main-26
front50-main-27
front50-main-28
front50-main-29
front50-main-3
front50-main-30
front50-main-31
front50-main-34
front50-main-4
front50-main-5
front50-main-6
front50-main-8
front50-main-9
gate-main-1
gate-main-10
gate-main-11
gate-main-12
gate-main-13
gate-main-14
gate-main-15
gate-main-16
gate-main-17
gate-main-18
gate-main-19
gate-main-2
gate-main-20
gate-main-21
gate-main-22
gate-main-23
gate-main-24
gate-main-25
gate-main-26
gate-main-27
gate-main-28
gate-main-29
gate-main-3
gate-main-30
gate-main-31
gate-main-32
gate-main-33
gate-main-34
gate-main-35
gate-main-36
gate-main-37
gate-main-38
gate-main-39
gate-main-4
gate-main-40
gate-main-41
gate-main-42
gate-main-46
gate-main-5
gate-main-6
gate-main-8
gate-main-9
halyard-main-1
halyard-main-10
halyard-main-11
halyard-main-12
halyard-main-13
halyard-main-14
halyard-main-15
halyard-main-16
halyard-main-17
halyard-main-18
halyard-main-19
halyard-main-2
halyard-main-20
halyard-main-21
halyard-main-22
halyard-main-23
halyard-main-24
halyard-main-25
halyard-main-26
halyard-main-27
halyard-main-28
halyard-main-29
halyard-main-3
halyard-main-30
halyard-main-31
halyard-main-32
halyard-main-33
halyard-main-34
halyard-main-35
halyard-main-36
halyard-main-37
halyard-main-38
halyard-main-39
halyard-main-4
halyard-main-40
halyard-main-41
halyard-main-42
halyard-main-43
halyard-main-44
halyard-main-45
halyard-main-46
halyard-main-47
halyard-main-48
halyard-main-49
halyard-main-5
halyard-main-50
halyard-main-52
halyard-main-53
halyard-main-54
halyard-main-55
halyard-main-56
halyard-main-57
halyard-main-58
halyard-main-59
halyard-main-6
halyard-main-60
halyard-main-61
halyard-main-62
halyard-main-65
halyard-main-7
halyard-main-8
igor-main-1
igor-main-10
igor-main-11
igor-main-12
igor-main-13
igor-main-14
igor-main-15
igor-main-16
igor-main-17
igor-main-18
igor-main-19
igor-main-2
igor-main-20
igor-main-21
igor-main-22
igor-main-23
igor-main-24
igor-main-25
igor-main-26
igor-main-27
igor-main-28
igor-main-29
igor-main-3
igor-main-30
igor-main-31
igor-main-32
igor-main-33
igor-main-36
igor-main-4
igor-main-5
igor-main-6
igor-main-8
kayenta-main-1
kayenta-main-10
kayenta-main-11
kayenta-main-12
kayenta-main-13
kayenta-main-14
kayenta-main-15
kayenta-main-16
kayenta-main-17
kayenta-main-18
kayenta-main-19
kayenta-main-2
kayenta-main-20
kayenta-main-21
kayenta-main-22
kayenta-main-23
kayenta-main-24
kayenta-main-25
kayenta-main-26
kayenta-main-27
kayenta-main-28
kayenta-main-29
kayenta-main-3
kayenta-main-30
kayenta-main-31
kayenta-main-32
kayenta-main-33
kayenta-main-34
kayenta-main-35
kayenta-main-36
kayenta-main-37
kayenta-main-38
kayenta-main-39
kayenta-main-4
kayenta-main-40
kayenta-main-41
kayenta-main-42
kayenta-main-43
kayenta-main-44
kayenta-main-45
kayenta-main-46
kayenta-main-47
kayenta-main-48
kayenta-main-49
kayenta-main-5
kayenta-main-50
kayenta-main-51
kayenta-main-52
kayenta-main-53
kayenta-main-54
kayenta-main-55
kayenta-main-56
kayenta-main-57
kayenta-main-58
kayenta-main-59
kayenta-main-6
kayenta-main-60
kayenta-main-61
kayenta-main-63
kayenta-main-64
kayenta-main-65
kayenta-main-66
kayenta-main-69
kayenta-main-7
kayenta-main-9
keel-main-1
keel-main-10
keel-main-11
keel-main-12
keel-main-13
keel-main-14
keel-main-15
keel-main-16
keel-main-17
keel-main-18
keel-main-19
keel-main-2
keel-main-20
keel-main-21
keel-main-22
keel-main-23
keel-main-24
keel-main-25
keel-main-26
keel-main-27
keel-main-28
keel-main-3
keel-main-31
keel-main-4
keel-main-5
keel-main-6
keel-main-8
keel-main-9
orca-main-1
orca-main-10
orca-main-11
orca-main-12
orca-main-13
orca-main-14
orca-main-15
orca-main-16
orca-main-17
orca-main-18
orca-main-19
orca-main-2
orca-main-20
orca-main-21
orca-main-22
orca-main-23
orca-main-24
orca-main-25
orca-main-26
orca-main-27
orca-main-28
orca-main-3
orca-main-30
orca-main-31
orca-main-32
orca-main-33
orca-main-34
orca-main-35
orca-main-36
orca-main-37
orca-main-38
orca-main-39
orca-main-4
orca-main-40
orca-main-41
orca-main-42
orca-main-43
orca-main-44
orca-main-45
orca-main-46
orca-main-47
orca-main-48
orca-main-49
orca-main-5
orca-main-50
orca-main-51
orca-main-52
orca-main-53
orca-main-54
orca-main-55
orca-main-56
orca-main-57
orca-main-58
orca-main-59
orca-main-6
orca-main-60
orca-main-62
orca-main-63
orca-main-64
orca-main-65
orca-main-68
orca-main-7
orca-main-9
rosco-main-1
rosco-main-10
rosco-main-11
rosco-main-12
rosco-main-14
rosco-main-15
rosco-main-16
rosco-main-17
rosco-main-18
rosco-main-19
rosco-main-2
rosco-main-20
rosco-main-21
rosco-main-22
rosco-main-23
rosco-main-24
rosco-main-26
rosco-main-27
rosco-main-3
rosco-main-30
rosco-main-4
rosco-main-5
rosco-main-6
rosco-main-8
rosco-main-9
bn-deck-kayenta-release-2025.*
bn-deck-kayenta-release-2025.0.x-0
bn-deck-kayenta-release-2025.1.x-0
bn-deck-kayenta-release-2025.3.x-6
bn-deck-kayenta-release-2025.4.x-6
bn-deck-release-2025.*
bn-deck-release-2025.0.x-0
bn-deck-release-2025.1.x-0
bn-fiat-release-2025.*
bn-fiat-release-2025.2.x-0
bn-fiat-release-2025.3.x-2
bn-front50-release-2025.*
bn-front50-release-2025.2.x-0
bn-front50-release-2025.3.x-2
bn-igor-release-2025.*
bn-igor-release-2025.2.x-0
bn-igor-release-2025.3.x-2
bn-kayenta-release-2025.*
bn-kayenta-release-2025.3.x-3
bn-keel-release-2025.*
bn-keel-release-2025.2.x-0
bn-keel-release-2025.3.x-2
bn-orca-release-2025.*
bn-orca-release-2025.3.x-3
bn-rosco-release-2025.*
bn-rosco-release-2025.2.x-0
bn-spin-release-2025.*
bn-spin-release-2025.0.x-0
bn-spin-release-2025.1.x-0
bn-spin-release-2025.2.x-0
bn-spin-release-2025.3.x-3
bn-spin-release-2025.4.x-0
bn-spin-release-2026.*
bn-spin-release-2026.0.x-3
clouddriver-2025.*
clouddriver-2025.0-0
clouddriver-2025.1-0
clouddriver-2025.1.0
clouddriver-2025.2-0
clouddriver-2025.2.0
clouddriver-2025.3-0
clouddriver-2025.3-2
clouddriver-2025.3-3
clouddriver-2025.3-4
clouddriver-2025.3-5
clouddriver-2025.3.0
clouddriver-2025.3.1
clouddriver-2025.4-0
clouddriver-2025.4-1
clouddriver-2025.4-2
clouddriver-2025.4-3
clouddriver-2025.4-4
clouddriver-2025.4-5
clouddriver-2025.4-6
clouddriver-2025.4.0
clouddriver-2025.4.1
clouddriver-2026.*
clouddriver-2026.0-3
clouddriver-2026.0-4
clouddriver-2026.0.0
deck-2025.*
deck-2025.1-0
deck-2025.1.0
deck-2025.2-0
deck-2025.2.0
deck-2025.3-0
deck-2025.3-3
deck-2025.3.0
deck-2025.3.1
deck-2025.4-0
deck-2025.4-4
deck-2025.4.0
deck-2025.4.1
deck-kayenta-2025.*
deck-kayenta-2025.1-0
deck-kayenta-2025.1.0
deck-kayenta-2025.2-0
deck-kayenta-2025.2.0
deck-kayenta-2025.3-0
deck-kayenta-2025.3.0
deck-kayenta-2025.3.1
deck-kayenta-2025.4-0
deck-kayenta-2025.4.0
deck-kayenta-2025.4.1
echo-2025.*
echo-2025.0-0
echo-2025.1-0
echo-2025.1.0
echo-2025.2-0
echo-2025.2.0
echo-2025.3-0
echo-2025.3-1
echo-2025.3-2
echo-2025.3.0
echo-2025.3.1
echo-2025.4-0
echo-2025.4-1
echo-2025.4-2
echo-2025.4-3
echo-2025.4.0
echo-2025.4.1
echo-2026.*
echo-2026.0-2
echo-2026.0-3
echo-2026.0.0
fiat-2025.*
fiat-2025.0-0
fiat-2025.1-0
fiat-2025.1.0
fiat-2025.2-0
fiat-2025.2.0
fiat-2025.3-0
fiat-2025.3-1
fiat-2025.3-2
fiat-2025.3.0
fiat-2025.3.1
fiat-2025.4-0
fiat-2025.4-1
fiat-2025.4-2
fiat-2025.4.0
fiat-2025.4.1
fiat-2026.*
fiat-2026.0-2
fiat-2026.0.0
front50-2025.*
front50-2025.0-0
front50-2025.1-0
front50-2025.1.0
front50-2025.2-0
front50-2025.2.0
front50-2025.3-0
front50-2025.3-1
front50-2025.3-2
front50-2025.3.0
front50-2025.3.1
front50-2025.4-0
front50-2025.4-1
front50-2025.4-2
front50-2025.4.0
front50-2025.4.1
front50-2026.*
front50-2026.0-2
front50-2026.0.0
gate-2025.*
gate-2025.0-0
gate-2025.1-0
gate-2025.1.0
gate-2025.2-0
gate-2025.2.0
gate-2025.3-0
gate-2025.3-1
gate-2025.3-2
gate-2025.3.0
gate-2025.3.1
gate-2025.4-0
gate-2025.4-1
gate-2025.4-2
gate-2025.4-3
gate-2025.4.0
gate-2025.4.1
gate-2026.*
gate-2026.0-2
gate-2026.0-3
gate-2026.0-4
gate-2026.0.0
halyard-2025.*
halyard-2025.0-0
halyard-2025.1-0
halyard-2025.1.0
halyard-2025.2-0
halyard-2025.2.0
halyard-2025.3-0
halyard-2025.3-1
halyard-2025.3-2
halyard-2025.3-3
halyard-2025.3-4
halyard-2025.3-5
halyard-2025.3-6
halyard-2025.3.0
halyard-2025.3.1
halyard-2025.4-0
halyard-2025.4-1
halyard-2025.4-2
halyard-2025.4-3
halyard-2025.4-4
halyard-2025.4-5
halyard-2025.4-6
halyard-2025.4-7
halyard-2025.4.0
halyard-2025.4.1
halyard-2026.*
halyard-2026.0-3
halyard-2026.0-4
halyard-2026.0.0
igor-2025.*
igor-2025.0-0
igor-2025.1-0
igor-2025.1.0
igor-2025.2-0
igor-2025.2.0
igor-2025.3-0
igor-2025.3-1
igor-2025.3-2
igor-2025.3.0
igor-2025.3.1
igor-2025.4-0
igor-2025.4-1
igor-2025.4-2
igor-2025.4.0
igor-2025.4.1
igor-2026.*
igor-2026.0-2
igor-2026.0.0
kayenta-2025.*
kayenta-2025.0-0
kayenta-2025.1-0
kayenta-2025.1.0
kayenta-2025.2-0
kayenta-2025.2.0
kayenta-2025.3-0
kayenta-2025.3-1
kayenta-2025.3-2
kayenta-2025.3-3
kayenta-2025.3.0
kayenta-2025.3.1
kayenta-2025.4-0
kayenta-2025.4-1
kayenta-2025.4-2
kayenta-2025.4-3
kayenta-2025.4-4
kayenta-2025.4.0
kayenta-2025.4.1
kayenta-2026.*
kayenta-2026.0-2
kayenta-2026.0.0
keel-2025.*
keel-2025.0-0
keel-2025.1-0
keel-2025.1.0
keel-2025.2-0
keel-2025.2.0
keel-2025.3-0
keel-2025.3-1
keel-2025.3-2
keel-2025.3.0
keel-2025.3.1
keel-2025.4-0
keel-2025.4-1
keel-2025.4-2
keel-2025.4.0
keel-2025.4.1
keel-2026.*
keel-2026.0-2
keel-2026.0.0
orca-2025.*
orca-2025.0-0
orca-2025.1-0
orca-2025.1.0
orca-2025.2-0
orca-2025.2.0
orca-2025.3-0
orca-2025.3-1
orca-2025.3-2
orca-2025.3-3
orca-2025.3.0
orca-2025.3.1
orca-2025.4-0
orca-2025.4-1
orca-2025.4-2
orca-2025.4-3
orca-2025.4-4
orca-2025.4.0
orca-2025.4.1
orca-2026.*
orca-2026.0-2
orca-2026.0.0
rosco-2025.*
rosco-2025.0-0
rosco-2025.1-0
rosco-2025.1.0
rosco-2025.2-0
rosco-2025.2.0
rosco-2025.3-0
rosco-2025.3-1
rosco-2025.3-2
rosco-2025.3.0
rosco-2025.3.1
rosco-2025.4-1
rosco-2025.4-2
rosco-2025.4-3
rosco-2025.4.0
rosco-2025.4.1
rosco-2026.*
rosco-2026.0-3
rosco-2026.0.0
spinnaker-release-2024.*
spinnaker-release-2024.0.0
spinnaker-release-2025.*
spinnaker-release-2025.2.0
spinnaker-release-2025.3.0
spinnaker-release-2025.3.1
spinnaker-release-2025.4.0
spinnaker-release-2025.4.1
Database specific
vanir_signatures
[
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "7729238453547684480961891590321363323",
"length": 147.0
},
"deprecated": false,
"id": "CVE-2026-32613-09161daa",
"target": {
"function": "GitRepoArtifactCredentials",
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactCredentials.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "298506883166373794577067824980824917152",
"length": 918.0
},
"deprecated": false,
"id": "CVE-2026-32613-0addf9bd",
"target": {
"function": "cloneOrPull",
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitJobExecutor.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"5497621926061787614681920255342698180",
"340182982242265501209165007809709498885",
"103958968029950381931537152082746606173",
"334828506433135861874979942180694854228"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-32613-45a3a0ff",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactConfiguration.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "139155116847106757566973004891377427557",
"length": 211.0
},
"deprecated": false,
"id": "CVE-2026-32613-5090e414",
"target": {
"function": "ExpectedArtifactExpressionEvaluationPostProcessor",
"file": "echo/echo-pipelinetriggers/src/main/java/com/netflix/spinnaker/echo/pipelinetriggers/postprocessors/ExpectedArtifactExpressionEvaluationPostProcessor.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"285719613654536594515574142172075184476",
"95077355848200363260943745551223085933",
"93827171729651818667437964459134625516",
"266094873682205093329859793737959919523",
"61616895900810301429579076289658391877",
"102095739902009433608497712183897697842",
"24363232535463917638490110081635767054",
"16833512841035586199130682589656892023",
"191986408303099052361022060107710126984",
"319017498140550577425748641303659171482",
"32380904515518074939743751639010693491",
"304091423959167035641271207415393609001",
"127760597369858620860875516595457630071",
"3280036126308676168482752715324533424",
"237456636875732689868373568496676943934",
"269983543879194016042111019760288139676",
"72231749768016330242257575355308892801"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-32613-60c2cc3e",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactAccount.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"53700598082466798908033504492642884154",
"215138800868894405310664986984636672133",
"141546563977676825682565619881894203658",
"63637559197929177631188945664125188919",
"138784393859536885108088900695333153092",
"36988513984363266069341883924742772296",
"33734825849021711635258359805618302978",
"154556100886931773789767590121809410041",
"4047351630023712816433146811753967957",
"238765742327084271711491416086752438128",
"195865322894186241038198901339685785031",
"6984440627401942935603300271229308052",
"114774787095804630982185305720455163794",
"339778759899333977499781191526438505048",
"236764516583661535331838352444664674854",
"40989921020998704080299698674255697575",
"199260232173592011441436549866498273941",
"146615497247996641198800686443434222204",
"87538565372074563780445996090326431068",
"316581709663333566796806135934747286104",
"133103685644011959070593792083994144286",
"88567468907249837177416710463029452084",
"224875877772954140826831896151133659934",
"14013044793438059072873736497670039367"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-32613-68ee04b5",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactCredentials.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "151890429271056851550724553964224811391",
"length": 532.0
},
"deprecated": false,
"id": "CVE-2026-32613-6dd63325",
"target": {
"function": "download",
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactCredentials.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "302869976012310252707219660030328517620",
"length": 594.0
},
"deprecated": false,
"id": "CVE-2026-32613-89ea4c15",
"target": {
"function": "processPipeline",
"file": "echo/echo-pipelinetriggers/src/main/java/com/netflix/spinnaker/echo/pipelinetriggers/postprocessors/ExpectedArtifactExpressionEvaluationPostProcessor.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "170978062883409652252248118056420669782",
"length": 322.0
},
"deprecated": false,
"id": "CVE-2026-32613-de6c2a81",
"target": {
"function": "archive",
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitJobExecutor.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"104759193315833268533051595394108699950",
"213657116434803905697664728884484372426",
"263770928682265681518359990128134800877",
"158686011840976768594999089226510659950",
"175786443223357585946388776042986410251",
"222249307309012435446502053110133651578",
"295658091764350258405849947822463284841",
"252711348614625083017287062819923584420",
"184343467897905078977366020907009558304",
"92185615237534023204951336273613920363",
"136167686550555654140779130885299822983",
"27923095991815526588399609791860118993",
"289295033717594432545858787930552335460",
"285586309385991461317051391481000489689",
"10885785054384653084200431194238315566",
"263298556189026497758521296193847364424",
"18990204868522107119900653774088069850",
"275441304944045186378763338827685182552",
"70933056620924313409026497914504768419",
"316236857124252684516333297484098530939",
"152805939706617308018808017651177053005",
"63572163356618238985630280364217410971"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-32613-e65be06c",
"target": {
"file": "echo/echo-pipelinetriggers/src/main/java/com/netflix/spinnaker/echo/pipelinetriggers/postprocessors/ExpectedArtifactExpressionEvaluationPostProcessor.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "200174727083935994597756181867925650858",
"length": 639.0
},
"deprecated": false,
"id": "CVE-2026-32613-e8704563",
"target": {
"function": "GitRepoArtifactAccount",
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactAccount.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"113841194868219201802325554001121448478",
"17826257160454724540353631166307172290",
"152076201362382341571773302502199513533",
"297522376512842471950736362083851666700",
"302965313114943976682957369077681754984",
"193574060178935607522263213933840371515",
"338648036141811586042792350312696586505",
"309063972870286961736417278701202386641",
"218499363905484864415412165289084046070",
"72381255312436400157996296813244629310",
"271397213442670050686075869650224461590",
"166587389687949307114255401466617864725",
"101526005138619413336192256248011769715",
"213987736454854133032224414160210441975",
"242616473467799770610964090071846076309",
"9370314403759255774914457737376628097",
"268184068276536869588461449563137945214",
"16531029899114726043184467545088373259",
"305945692589769636345565571745200813284",
"205109281613136104258724329850690948311"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-32613-f737ae30",
"target": {
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitJobExecutor.java"
}
},
{
"source": "https://github.com/spinnaker/spinnaker/commit/8dfcb8e9a5f2428828ad03c0ccb9684fdf1425aa",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "20564213726775893638325955562671798803",
"length": 580.0
},
"deprecated": false,
"id": "CVE-2026-32613-fb5d91d8",
"target": {
"function": "gitCredentialsProperties",
"file": "clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/gitRepo/GitRepoArtifactConfiguration.java"
}
}
]
vanir_signatures_modified
"2026-07-17T07:03:24Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32613.json"