Deserialization of untrusted data in Netflix Spinnaker
Priority MEDIUM 41CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.
Summary
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.
Why it matters now
EPSS 0.01523 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Netflix Spinnaker | All versions prior to version 1.23.4, 1.22.4 or 1.21.5 | — | No fix listed | CNA |
- Netflix Spinnaker Vendor— Affected All versions prior to version 1.23.4, 1.22.4 or 1.21.5 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* | before 1.21.5; 1.22.0 to before 1.22.4; 1.23.0 to before 1.23.4 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* Versions before 1.21.5; 1.22.0 to before 1.22.4; 1.23.0 to before 1.23.4 Vulnerable ·backstage
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9301
- 2026-10-03 Alias added: GHSA-mgvh-5mj6-fprr
References
More backstage Spinnaker vulnerabilities
- TI-2021-16529 Path Traversal in spinnaker CVSS 3.1HIGH 7.1
- TI-2021-19638 Improper Access Control in spinnaker CVSS 3.1CRITICAL 10.0
- TI-2026-25122 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling CVSS 3.1CRITICAL 10.0
- TI-2026-25113 Improper input validation in spinnaker CVSS 3.1CRITICAL 10.0
- TI-2026-32679 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types CVSS 3.1HIGH 8.8
- TI-2026-39859 Spinnaker: Improper yaml processing on kustomize bake operations CVSS 3.1HIGH 7.5
Sources
- CVE-2020-9301 · CVE Program
- CVE-2020-9301 · NVD
- FIRST EPSS
- GHSA-mgvh-5mj6-fprr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences