CVE-2026-32613
Received Received - Intake
Spring Expression Language Injection in Spinnaker Echo Enables Remote Code Execution

Publication date: 2026-04-20

Last updated on: 2026-04-23

Assigner: GitHub, Inc.

Description
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-20
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-04-21
EPSS Evaluated
2026-06-15
NVD
CVE-2026-32613
EUVD
EUVD-2026-23964
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linuxfoundation spinnaker to 2025.3.2 (exc)
linuxfoundation spinnaker From 2025.4.0 (inc) to 2025.4.2 (exc)
linuxfoundation spinnaker From 2026.0.0 (inc) to 2026.0.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Spinnaker's Echo service, which uses Spring Expression Language (SPeL) to process information about expected artifacts. In certain versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, Echo did not restrict the SPeL context to a set of trusted classes. Instead, it allowed full Java Virtual Machine (JVM) access, enabling users to execute arbitrary Java classes.

This lack of restriction allows an attacker to invoke system commands, access files, and perform other potentially harmful actions on the system running Spinnaker.

The vulnerability is patched in versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2. As a temporary workaround, disabling the Echo service entirely can mitigate the risk.

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker with access to the Echo service to execute arbitrary code on the system.

  • Execution of arbitrary system commands.
  • Access to sensitive files on the system.
  • Potential full compromise of the affected system.

The CVSS v3.1 base score of 9.9 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Mitigation Strategies

To mitigate this vulnerability immediately, you should disable the Echo service entirely as a workaround.

Additionally, upgrade Spinnaker to one of the patched versions: 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2.

Compliance Impact

The vulnerability allows full JVM access through the Spinnaker Echo service, enabling arbitrary code execution, command invocation, and file access. This level of access can lead to unauthorized disclosure, modification, or destruction of sensitive data.

Such unauthorized access and potential data breaches could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

However, the provided information does not explicitly mention compliance impacts or regulatory considerations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart