CVE-2026-32613: linuxfoundation spinnaker Code Injection

Vulnerability summary

CVE-2026-32613 is a critical (CVSS 10.0) Code Injection vulnerability in linuxfoundation spinnaker. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.8% of scored vulnerabilities.

Timeline

1. 20-04-2026
   PublishedVulnerability first disclosed.
2. 23-04-2026
   Last modifiedVulnerability information updated.

Description

Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.