CVE-2026-25534
URL Validation Bypass in Spinnaker Clouddriver and Orca
Publication date: 2026-03-17
Last updated on: 2026-03-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spinnaker | clouddriver | From 2025.4.1 (inc) |
| spinnaker | clouddriver | From 2025.3.1 (inc) |
| spinnaker | clouddriver | From 2025.2.4 (inc) |
| spinnaker | clouddriver | From 2026.0.0 (inc) |
| spinnaker | orca | From 2025.4.1 (inc) |
| spinnaker | orca | From 2025.3.1 (inc) |
| spinnaker | orca | From 2025.2.4 (inc) |
| spinnaker | orca | From 2026.0.0 (inc) |
| spinnaker | clouddriver | From 2025.2.4 (inc) to 2026.1.0 (inc) |
| spinnaker | orca | From 2025.2.4 (inc) to 2026.1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-25534 is a critical vulnerability in the Spinnaker platform affecting the Clouddriver and Orca components. It arises from improper URL validation logic that fails to correctly handle underscores in hostnames during URL parsing. This flaw is due to the underlying Java URL object's inability to properly parse underscores, allowing attackers to bypass previous URL validation protections."}, {'type': 'paragraph', 'content': "The vulnerability leads to Server-Side Request Forgery (SSRF), where attackers can craft malicious URLs that bypass security checks and potentially access unauthorized resources. It impacts both Clouddriver's user input sanitation and Orca's fromUrl expression handling."}] [1]
How can this vulnerability impact me? :
This vulnerability can have serious impacts including high confidentiality loss, low integrity loss, and low availability loss. Attackers exploiting this flaw can bypass URL validation to perform SSRF attacks, potentially accessing unauthorized internal resources or sensitive data.
The attack vector is network-based with low complexity, requiring low privileges and no user interaction, but it causes a scope change affecting multiple components within Spinnaker.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability arises from improper URL validation that fails to correctly handle underscores in hostnames during URL parsing in Spinnaker's Clouddriver and Orca components. Detection involves identifying attempts to use carefully crafted URLs containing underscores in hostnames that bypass URL validation."}, {'type': 'paragraph', 'content': 'Since the vulnerability is related to URL parsing and validation, monitoring logs for URLs with underscores in hostnames or unusual URL patterns in requests to Clouddriver or Orca components can help detect exploitation attempts.'}, {'type': 'paragraph', 'content': 'Specific commands are not provided in the available resources, but general approaches include:'}, {'type': 'list_item', 'content': 'Inspect application logs for URLs containing underscores in hostnames.'}, {'type': 'list_item', 'content': 'Use network monitoring tools (e.g., tcpdump, Wireshark) to capture HTTP requests to Spinnaker services and filter for URLs with underscores.'}, {'type': 'list_item', 'content': "Search logs or captured traffic with commands like: `grep -r '_.' /path/to/spinnaker/logs` to find URLs with underscores."}, {'type': 'list_item', 'content': 'Use custom scripts or tools to parse URLs in logs and flag those with underscores in hostnames.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the patches released for this vulnerability or using available workarounds until patches can be applied.
- Upgrade Spinnaker to one of the patched versions: 2025.3.1, 2025.4.1, 2025.2.4, 2026.0.0, or later releases.
- As a temporary workaround, disable the affected artifact components (Clouddriver and Orca artifacts) on the system to prevent exploitation.
These steps help prevent attackers from exploiting the URL validation bypass caused by underscores in hostnames.