Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Priority LOW 39CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result. ### Patches This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0. ### Workarounds You can disable the various artifacts on this system to work around these limits.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 18th percentileScored 2026-11-07
Fix Fixed clouddriver-artifacts (io.spinnaker.clouddriver): 2025.2.4, 2025.3.1, 2025.4.1orca-core (io.spinnaker.orca): 2025.2.4, 2025.3.1, 2025.4.1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| io.spinnaker.clouddriver | clouddriver-artifacts | before 2025.2.4; 2025.3.0 to before 2025.3.1; 2025.4.0 to before 2025.4.1 | 2025.2.4, 2025.3.1, 2025.4.1 | Patch available | CNA |
| io.spinnaker.orca | orca-core | before 2025.2.4; 2025.3.0 to before 2025.3.1; 2025.4.0 to before 2025.4.1 | 2025.2.4, 2025.3.1, 2025.4.1 | Patch available | CNA |
| — | io.spinnaker.clouddriver:clouddriver-artifacts (Maven) | 2025.1.6 to before 2025.2.4 | 2025.2.4 | Patch available | GHSA-8r8j-gfhg-fw38 |
| — | io.spinnaker.clouddriver:clouddriver-artifacts (Maven) | 2025.3.0 to before 2025.3.1 | 2025.3.1 | Patch available | GHSA-8r8j-gfhg-fw38 |
| — | io.spinnaker.clouddriver:clouddriver-artifacts (Maven) | 2025.4.0 to before 2025.4.1 | 2025.4.1 | Patch available | GHSA-8r8j-gfhg-fw38 |
| — | io.spinnaker.orca:orca-core (Maven) | 2025.1.6 to before 2025.2.4 | 2025.2.4 | Patch available | GHSA-8r8j-gfhg-fw38 |
| — | io.spinnaker.orca:orca-core (Maven) | 2025.3.0 to before 2025.3.1 | 2025.3.1 | Patch available | GHSA-8r8j-gfhg-fw38 |
| — | io.spinnaker.orca:orca-core (Maven) | 2025.4.0 to before 2025.4.1 | 2025.4.1 | Patch available | GHSA-8r8j-gfhg-fw38 |
- clouddriver-artifacts Vendorio.spinnaker.clouddriver Affected before 2025.2.4; 2025.3.0 to before 2025.3.1; 2025.4.0 to before 2025.4.1 Fixed in 2025.2.4, 2025.3.1, 2025.4.1 Patch available CNA
- orca-core Vendorio.spinnaker.orca Affected before 2025.2.4; 2025.3.0 to before 2025.3.1; 2025.4.0 to before 2025.4.1 Fixed in 2025.2.4, 2025.3.1, 2025.4.1 Patch available CNA
- io.spinnaker.clouddriver:clouddriver-artifacts (Maven) Vendor— Affected 2025.1.6 to before 2025.2.4 Fixed in 2025.2.4 Patch available GHSA-8r8j-gfhg-fw38
- io.spinnaker.clouddriver:clouddriver-artifacts (Maven) Vendor— Affected 2025.3.0 to before 2025.3.1 Fixed in 2025.3.1 Patch available GHSA-8r8j-gfhg-fw38
- io.spinnaker.clouddriver:clouddriver-artifacts (Maven) Vendor— Affected 2025.4.0 to before 2025.4.1 Fixed in 2025.4.1 Patch available GHSA-8r8j-gfhg-fw38
- io.spinnaker.orca:orca-core (Maven) Vendor— Affected 2025.1.6 to before 2025.2.4 Fixed in 2025.2.4 Patch available GHSA-8r8j-gfhg-fw38
- io.spinnaker.orca:orca-core (Maven) Vendor— Affected 2025.3.0 to before 2025.3.1 Fixed in 2025.3.1 Patch available GHSA-8r8j-gfhg-fw38
- io.spinnaker.orca:orca-core (Maven) Vendor— Affected 2025.4.0 to before 2025.4.1 Fixed in 2025.4.1 Patch available GHSA-8r8j-gfhg-fw38
Remediation
- Fix · CNA clouddriver-artifacts (io.spinnaker.clouddriver) Fixed in 2025.2.4, 2025.3.1, 2025.4.1
- Fix · CNA orca-core (io.spinnaker.orca) Fixed in 2025.2.4, 2025.3.1, 2025.4.1
- Fix · GHSA-8r8j-gfhg-fw38 io.spinnaker.clouddriver:clouddriver-artifacts (Maven) Fixed in 2025.2.4 Advisory →
- Fix · GHSA-8r8j-gfhg-fw38 io.spinnaker.clouddriver:clouddriver-artifacts (Maven) Fixed in 2025.3.1 Advisory →
- Fix · GHSA-8r8j-gfhg-fw38 io.spinnaker.clouddriver:clouddriver-artifacts (Maven) Fixed in 2025.4.1 Advisory →
- Fix · GHSA-8r8j-gfhg-fw38 io.spinnaker.orca:orca-core (Maven) Fixed in 2025.2.4 Advisory →
- Fix · GHSA-8r8j-gfhg-fw38 io.spinnaker.orca:orca-core (Maven) Fixed in 2025.3.1 Advisory →
- Fix · GHSA-8r8j-gfhg-fw38 io.spinnaker.orca:orca-core (Maven) Fixed in 2025.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25534
- 2026-10-03 Alias added: GHSA-8r8j-gfhg-fw38
- 2026-10-14 Priority changed: LOW → MEDIUM
- 2026-10-25 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-25534 · CVE Program
- CVE-2026-25534 · NVD
- FIRST EPSS
- GHSA-8r8j-gfhg-fw38 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences