CVE-2026-32613
Spring Expression Language Injection in Spinnaker Echo Enables Remote Code Execution
Publication date: 2026-04-20
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | spinnaker | to 2025.3.2 (exc) |
| linuxfoundation | spinnaker | From 2025.4.0 (inc) to 2025.4.2 (exc) |
| linuxfoundation | spinnaker | From 2026.0.0 (inc) to 2026.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Spinnaker's Echo service, which uses Spring Expression Language (SPeL) to process information about expected artifacts. In certain versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, Echo did not restrict the SPeL context to a set of trusted classes. Instead, it allowed full Java Virtual Machine (JVM) access, enabling users to execute arbitrary Java classes.
This lack of restriction allows an attacker to invoke system commands, access files, and perform other potentially harmful actions on the system running Spinnaker.
The vulnerability is patched in versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2. As a temporary workaround, disabling the Echo service entirely can mitigate the risk.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an attacker with access to the Echo service to execute arbitrary code on the system.
- Execution of arbitrary system commands.
- Access to sensitive files on the system.
- Potential full compromise of the affected system.
The CVSS v3.1 base score of 9.9 indicates a critical severity with high impact on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should disable the Echo service entirely as a workaround.
Additionally, upgrade Spinnaker to one of the patched versions: 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows full JVM access through the Spinnaker Echo service, enabling arbitrary code execution, command invocation, and file access. This level of access can lead to unauthorized disclosure, modification, or destruction of sensitive data.
Such unauthorized access and potential data breaches could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.
However, the provided information does not explicitly mention compliance impacts or regulatory considerations.