Spinnaker Clouddriver and Orca URL Validation Bypass Vulnerability

Severity

HIGH

Affected component

io.spinnaker.clouddriver:clouddriver-artifacts (maven)

Affected versions

>= echo-2025.1-3, <= echo-2025.1-3 or >= bn-echo-release-2025.1.x-3, <= bn-echo-release-2025.1.x-3 or >= echo-2025.2-1, <= echo-2025.2-1 or >= bn-echo-release-2025.2.x-1, <= bn-echo-release-2025.2.x-1 or >= orca-2025.1-8, <= orca-2025.1-8 or >= kayenta-2025.1-8, <= kayenta-2025.1-8 or >= orca-2025.2-6, <= orca-2025.2-6 or >= kayenta-2025.2-6, <= kayenta-2025.2-6 or >= gate-2025.2-3, <= gate-2025.2-3 or >= bn-gate-release-2025.2.x-3, <= bn-gate-release-2025.2.x-3 or >= gate-2025.1-3, <= gate-2025.1-3 or >= bn-gate-release-2025.1.x-3, <= bn-gate-release-2025.1.x-3 or >= halyard-2025.1-10, <= halyard-2025.1-10 or >= clouddriver-2025.1-8, <= clouddriver-2025.1-8 or >= bn-halyard-release-2025.1.x-10, <= bn-halyard-release-2025.1.x-10 or >= bn-clouddriver-release-2025.1.x-8, <= bn-clouddriver-release-2025.1.x-8 or >= orca-2025.2-5, <= orca-2025.2-5 or >= kayenta-2025.2-5, <= kayenta-2025.2-5 or >= orca-2025.1-7, <= orca-2025.1-7 or >= kayenta-2025.1-7, <= kayenta-2025.1-7 or >= halyard-2025.2-3, <= halyard-2025.2-3 or >= clouddriver-2025.2-3, <= clouddriver-2025.2-3 or >= orca-2025.1-6, <= orca-2025.1-6 or >= kayenta-2025.1-6, <= kayenta-2025.1-6 or >= halyard-2025.1-9, <= halyard-2025.1-9 or >= clouddriver-2025.1-7, <= clouddriver-2025.1-7 or >= orca-2025.2-4, <= orca-2025.2-4 or >= kayenta-2025.2-4, <= kayenta-2025.2-4 or >= halyard-2025.2-2, <= halyard-2025.2-2 or >= clouddriver-2025.2-2, <= clouddriver-2025.2-2 or >= spinnaker-release-2025.1.5, <= spinnaker-release-2025.1.5 or >= rosco-2025.1.5, <= rosco-2025.1.5 or >= orca-2025.1.5, <= orca-2025.1.5 or >= orca-2025.1-5, <= orca-2025.1-5 or >= keel-2025.1.5, <= keel-2025.1.5 or >= kayenta-2025.1.5, <= kayenta-2025.1.5 or >= kayenta-2025.1-5, <= kayenta-2025.1-5 or >= igor-2025.1.5, <= igor-2025.1.5 or >= halyard-2025.1.5, <= halyard-2025.1.5 or >= halyard-2025.1-8, <= halyard-2025.1-8 or >= gate-2025.1.5, <= gate-2025.1.5 or >= front50-2025.1.5, <= front50-2025.1.5 or >= fiat-2025.1.5, <= fiat-2025.1.5 or >= echo-2025.1.5, <= echo-2025.1.5 or >= deck-kayenta-2025.1.5, <= deck-kayenta-2025.1.5 or >= deck-2025.1.5, <= deck-2025.1.5 or >= clouddriver-2025.1.5, <= clouddriver-2025.1.5 or >= clouddriver-2025.1-6, <= clouddriver-2025.1-6 or >= orca-2025.2-3, <= orca-2025.2-3 or >= kayenta-2025.2-3, <= kayenta-2025.2-3 or >= halyard-2025.2-1, <= halyard-2025.2-1 or >= clouddriver-2025.2-1, <= clouddriver-2025.2-1 or >= orca-2025.2-2, <= orca-2025.2-2 or >= kayenta-2025.2-2, <= kayenta-2025.2-2 or >= orca-2025.1-4, <= orca-2025.1-4 or >= kayenta-2025.1-4, <= kayenta-2025.1-4 or >= orca-2025.2-1, <= orca-2025.2-1 or >= kayenta-2025.2-1, <= kayenta-2025.2-1 or >= orca-2025.1-3, <= orca-2025.1-3 or >= kayenta-2025.1-3, <= kayenta-2025.1-3 or >= spinnaker-release-2025.2.2, <= spinnaker-release-2025.2.2 or >= rosco-2025.2.2, <= rosco-2025.2.2 or >= orca-2025.2.2, <= orca-2025.2.2 or >= keel-2025.2.2, <= keel-2025.2.2 or >= kayenta-2025.2.2, <= kayenta-2025.2.2 or >= igor-2025.2.2, <= igor-2025.2.2 or >= halyard-2025.2.2, <= halyard-2025.2.2 or >= gate-2025.2.2, <= gate-2025.2.2 or >= gate-2025.2-2, <= gate-2025.2-2 or >= front50-2025.2.2, <= front50-2025.2.2 or >= fiat-2025.2.2, <= fiat-2025.2.2 or >= echo-2025.2.2, <= echo-2025.2.2 or >= deck-kayenta-2025.2.2, <= deck-kayenta-2025.2.2 or >= deck-2025.2.2, <= deck-2025.2.2 or >= clouddriver-2025.2.2, <= clouddriver-2025.2.2 or >= spinnaker-release-2025.1.4, <= spinnaker-release-2025.1.4 or >= rosco-2025.1.4, <= rosco-2025.1.4 or >= orca-2025.1.4, <= orca-2025.1.4 or >= keel-2025.1.4, <= keel-2025.1.4 or >= kayenta-2025.1.4, <= kayenta-2025.1.4 or >= igor-2025.1.4, <= igor-2025.1.4 or >= halyard-2025.1.4, <= halyard-2025.1.4 or >= halyard-2025.1-7, <= halyard-2025.1-7 or >= gate-2025.1.4, <= gate-2025.1.4 or >= front50-2025.1.4, <= front50-2025.1.4 or >= fiat-2025.1.4, <= fiat-2025.1.4 or >= echo-2025.1.4, <= echo-2025.1.4 or >= deck-kayenta-2025.1.4, <= deck-kayenta-2025.1.4 or >= deck-2025.1.4, <= deck-2025.1.4 or >= clouddriver-2025.1.4, <= clouddriver-2025.1.4 or >= clouddriver-2025.1-5, <= clouddriver-2025.1-5 or >= spinnaker-release-2025.2.1, <= spinnaker-release-2025.2.1 or >= rosco-2025.2.1, <= rosco-2025.2.1 or >= orca-2025.2.1, <= orca-2025.2.1 or >= keel-2025.2.1, <= keel-2025.2.1 or >= kayenta-2025.2.1, <= kayenta-2025.2.1 or >= igor-2025.2.1, <= igor-2025.2.1 or >= halyard-2025.2.1, <= halyard-2025.2.1 or >= gate-2025.2.1, <= gate-2025.2.1 or >= gate-2025.2-1, <= gate-2025.2-1 or >= front50-2025.2.1, <= front50-2025.2.1 or >= fiat-2025.2.1, <= fiat-2025.2.1 or >= echo-2025.2.1, <= echo-2025.2.1 or >= deck-kayenta-2025.2.1, <= deck-kayenta-2025.2.1 or >= deck-2025.2.1, <= deck-2025.2.1 or >= clouddriver-2025.2.1, <= clouddriver-2025.2.1 or >= spinnaker-release-2025.2.0, <= spinnaker-release-2025.2.0 or >= rosco-main-22, <= rosco-main-22 or >= rosco-2025.2.0, <= rosco-2025.2.0 or >= rosco-2025.2-0, <= rosco-2025.2-0 or >= orca-main-36, <= orca-main-36 or >= orca-2025.2.0, <= orca-2025.2.0 or >= orca-2025.2-0, <= orca-2025.2-0 or >= keel-main-23, <= keel-main-23 or >= keel-2025.2.0, <= keel-2025.2.0 or >= keel-2025.2-0, <= keel-2025.2-0 or >= kayenta-main-37, <= kayenta-main-37 or >= kayenta-2025.2.0, <= kayenta-2025.2.0 or >= kayenta-2025.2-0, <= kayenta-2025.2-0 or >= igor-main-27, <= igor-main-27 or >= igor-2025.2.0, <= igor-2025.2.0 or >= igor-2025.2-0, <= igor-2025.2-0 or >= halyard-main-45, <= halyard-main-45 or >= halyard-2025.2.0, <= halyard-2025.2.0 or >= halyard-2025.2-0, <= halyard-2025.2-0 or >= gate-main-29, <= gate-main-29 or >= gate-2025.2.0, <= gate-2025.2.0 or >= gate-2025.2-0, <= gate-2025.2-0 or >= front50-main-23, <= front50-main-23 or >= front50-2025.2.0, <= front50-2025.2.0 or >= front50-2025.2-0, <= front50-2025.2-0 or >= fiat-main-22, <= fiat-main-22 or >= fiat-2025.2.0, <= fiat-2025.2.0 or >= fiat-2025.2-0, <= fiat-2025.2-0 or >= echo-main-28, <= echo-main-28 or >= echo-2025.2.0, <= echo-2025.2.0 or >= echo-2025.2-0, <= echo-2025.2-0 or >= deck-kayenta-2025.2.0, <= deck-kayenta-2025.2.0 or >= deck-kayenta-2025.2-0, <= deck-kayenta-2025.2-0 or >= deck-2025.2.0, <= deck-2025.2.0 or >= deck-2025.2-0, <= deck-2025.2-0 or >= clouddriver-main-43, <= clouddriver-main-43 or >= clouddriver-2025.2.0, <= clouddriver-2025.2.0 or >= clouddriver-2025.2-0, <= clouddriver-2025.2-0 or >= bn-spin-release-2025.2.x-0, <= bn-spin-release-2025.2.x-0 or >= bn-rosco-release-2025.2.x-0, <= bn-rosco-release-2025.2.x-0 or >= bn-keel-release-2025.2.x-0, <= bn-keel-release-2025.2.x-0 or >= bn-igor-release-2025.2.x-0, <= bn-igor-release-2025.2.x-0 or >= bn-front50-release-2025.2.x-0, <= bn-front50-release-2025.2.x-0 or >= bn-fiat-release-2025.2.x-0, <= bn-fiat-release-2025.2.x-0 or >= spinnaker-release-2025.1.3, <= spinnaker-release-2025.1.3 or >= rosco-2025.1.3, <= rosco-2025.1.3 or >= orca-2025.1.3, <= orca-2025.1.3 or >= keel-2025.1.3, <= keel-2025.1.3 or >= kayenta-2025.1.3, <= kayenta-2025.1.3 or >= igor-2025.1.3, <= igor-2025.1.3 or >= halyard-2025.1.3, <= halyard-2025.1.3 or >= halyard-2025.1-6, <= halyard-2025.1-6 or >= gate-2025.1.3, <= gate-2025.1.3 or >= front50-2025.1.3, <= front50-2025.1.3 or >= fiat-2025.1.3, <= fiat-2025.1.3 or >= echo-2025.1.3, <= echo-2025.1.3 or >= deck-kayenta-2025.1.3, <= deck-kayenta-2025.1.3 or >= deck-2025.1.3, <= deck-2025.1.3 or >= clouddriver-2025.1.3, <= clouddriver-2025.1.3 or >= clouddriver-2025.1-4, <= clouddriver-2025.1-4 or >= halyard-2025.1-5, <= halyard-2025.1-5 or >= rosco-2025.1-1, <= rosco-2025.1-1 or >= orca-2025.1-2, <= orca-2025.1-2 or >= keel-2025.1-1, <= keel-2025.1-1 or >= kayenta-2025.1-2, <= kayenta-2025.1-2 or >= igor-2025.1-1, <= igor-2025.1-1 or >= halyard-2025.1-4, <= halyard-2025.1-4 or >= gate-2025.1-2, <= gate-2025.1-2 or >= front50-2025.1-1, <= front50-2025.1-1 or >= fiat-2025.1-1, <= fiat-2025.1-1 or >= echo-2025.1-2, <= echo-2025.1-2 or >= clouddriver-2025.1-3, <= clouddriver-2025.1-3 or >= bn-rosco-release-2025.1.x-1, <= bn-rosco-release-2025.1.x-1 or >= bn-keel-release-2025.1.x-1, <= bn-keel-release-2025.1.x-1 or >= bn-igor-release-2025.1.x-1, <= bn-igor-release-2025.1.x-1 or >= bn-front50-release-2025.1.x-1, <= bn-front50-release-2025.1.x-1 or >= bn-fiat-release-2025.1.x-1, <= bn-fiat-release-2025.1.x-1 or >= gate-2025.1-1, <= gate-2025.1-1 or >= spinnaker-release-2025.1.2, <= spinnaker-release-2025.1.2 or >= rosco-2025.1.2, <= rosco-2025.1.2 or >= orca-2025.1.2, <= orca-2025.1.2 or >= keel-2025.1.2, <= keel-2025.1.2 or >= kayenta-2025.1.2, <= kayenta-2025.1.2 or >= igor-2025.1.2, <= igor-2025.1.2 or >= halyard-2025.1.2, <= halyard-2025.1.2 or >= halyard-2025.1-3, <= halyard-2025.1-3 or >= gate-2025.1.2, <= gate-2025.1.2 or >= front50-2025.1.2, <= front50-2025.1.2 or >= fiat-2025.1.2, <= fiat-2025.1.2 or >= echo-2025.1.2, <= echo-2025.1.2 or >= deck-kayenta-2025.1.2, <= deck-kayenta-2025.1.2 or >= deck-2025.1.2, <= deck-2025.1.2 or >= clouddriver-2025.1.2, <= clouddriver-2025.1.2 or >= clouddriver-2025.1-2, <= clouddriver-2025.1-2 or >= echo-2025.1-1, <= echo-2025.1-1 or >= halyard-2025.1-2, <= halyard-2025.1-2 or >= halyard-2025.1-1, <= halyard-2025.1-1 or >= clouddriver-2025.1-1, <= clouddriver-2025.1-1 or >= spinnaker-release-2025.1.1, <= spinnaker-release-2025.1.1 or >= rosco-2025.1.1, <= rosco-2025.1.1 or >= orca-2025.1.1, <= orca-2025.1.1 or >= orca-2025.1-1, <= orca-2025.1-1 or >= keel-2025.1.1, <= keel-2025.1.1 or >= kayenta-2025.1.1, <= kayenta-2025.1.1 or >= kayenta-2025.1-1, <= kayenta-2025.1-1 or >= igor-2025.1.1, <= igor-2025.1.1 or >= halyard-2025.1.1, <= halyard-2025.1.1 or >= gate-2025.1.1, <= gate-2025.1.1 or >= front50-2025.1.1, <= front50-2025.1.1 or >= fiat-2025.1.1, <= fiat-2025.1.1 or >= echo-2025.1.1, <= echo-2025.1.1 or >= deck-kayenta-2025.1.1, <= deck-kayenta-2025.1.1 or >= deck-2025.1.1, <= deck-2025.1.1 or >= clouddriver-2025.1.1, <= clouddriver-2025.1.1 or >= spinnaker-release-2025.1.0, <= spinnaker-release-2025.1.0 or >= rosco-2025.1.0, <= rosco-2025.1.0 or >= rosco-2025.1-0, <= rosco-2025.1-0 or >= orca-main-32, <= orca-main-32 or >= orca-2025.1.0, <= orca-2025.1.0 or >= orca-2025.1-0, <= orca-2025.1-0 or >= keel-2025.1.0, <= keel-2025.1.0 or >= keel-2025.1-0, <= keel-2025.1-0 or >= kayenta-main-33, <= kayenta-main-33 or >= kayenta-2025.1.0, <= kayenta-2025.1.0 or >= kayenta-2025.1-0, <= kayenta-2025.1-0 or >= igor-2025.1.0, <= igor-2025.1.0 or >= igor-2025.1-0, <= igor-2025.1-0 or >= halyard-2025.1.0, <= halyard-2025.1.0 or >= halyard-2025.1-0, <= halyard-2025.1-0 or >= gate-2025.1.0, <= gate-2025.1.0 or >= gate-2025.1-0, <= gate-2025.1-0 or >= front50-2025.1.0, <= front50-2025.1.0 or >= front50-2025.1-0, <= front50-2025.1-0 or >= fiat-2025.1.0, <= fiat-2025.1.0 or >= fiat-2025.1-0, <= fiat-2025.1-0 or >= echo-2025.1.0, <= echo-2025.1.0 or >= echo-2025.1-0, <= echo-2025.1-0 or >= deck-kayenta-2025.1.0, <= deck-kayenta-2025.1.0 or >= deck-kayenta-2025.1-0, <= deck-kayenta-2025.1-0 or >= deck-2025.1.0, <= deck-2025.1.0 or >= deck-2025.1-0, <= deck-2025.1-0 or >= clouddriver-2025.1.0, <= clouddriver-2025.1.0 or >= clouddriver-2025.1-0, <= clouddriver-2025.1-0 or >= bn-spin-release-2025.1.x-0, <= bn-spin-release-2025.1.x-0 or >= bn-deck-release-2025.1.x-0, <= bn-deck-release-2025.1.x-0 or >= bn-deck-kayenta-release-2025.1.x-0, <= bn-deck-kayenta-release-2025.1.x-0 or >= rosco-main-19, <= rosco-main-19 or >= orca-main-31, <= orca-main-31 or >= keel-main-20, <= keel-main-20 or >= kayenta-main-32, <= kayenta-main-32 or >= igor-main-24, <= igor-main-24 or >= halyard-main-32, <= halyard-main-32 or >= gate-main-24, <= gate-main-24 or >= front50-main-20, <= front50-main-20 or >= fiat-main-19, <= fiat-main-19 or >= echo-main-24, <= echo-main-24 or >= clouddriver-main-32, <= clouddriver-main-32 or >= rosco-main-18, <= rosco-main-18 or >= orca-main-30, <= orca-main-30 or >= keel-main-19, <= keel-main-19 or >= kayenta-main-31, <= kayenta-main-31 or >= igor-main-23, <= igor-main-23 or >= halyard-main-31, <= halyard-main-31 or >= gate-main-23, <= gate-main-23 or >= front50-main-19, <= front50-main-19 or >= fiat-main-18, <= fiat-main-18 or >= echo-main-23, <= echo-main-23 or >= clouddriver-main-31, <= clouddriver-main-31 or >= gate-main-22, <= gate-main-22 or >= kayenta-main-30, <= kayenta-main-30 or >= halyard-main-30, <= halyard-main-30 or >= clouddriver-main-30, <= clouddriver-main-30 or >= orca-main-28, <= orca-main-28 or >= kayenta-main-29, <= kayenta-main-29 or >= halyard-main-29, <= halyard-main-29 or >= clouddriver-main-29, <= clouddriver-main-29 or >= keel-main-18, <= keel-main-18 or >= halyard-main-28, <= halyard-main-28 or >= clouddriver-main-28, <= clouddriver-main-28 or >= halyard-main-27, <= halyard-main-27 or >= clouddriver-main-27, <= clouddriver-main-27 or >= rosco-main-17, <= rosco-main-17 or >= orca-main-27, <= orca-main-27 or >= keel-main-17, <= keel-main-17 or >= kayenta-main-28, <= kayenta-main-28 or >= igor-main-22, <= igor-main-22 or >= halyard-main-26, <= halyard-main-26 or >= gate-main-21, <= gate-main-21 or >= front50-main-18, <= front50-main-18 or >= fiat-main-17, <= fiat-main-17 or >= echo-main-22, <= echo-main-22 or >= clouddriver-main-26, <= clouddriver-main-26 or >= orca-main-26, <= orca-main-26 or >= kayenta-main-27, <= kayenta-main-27 or >= halyard-main-25, <= halyard-main-25 or >= clouddriver-main-25, <= clouddriver-main-25 or >= orca-main-25, <= orca-main-25 or >= kayenta-main-26, <= kayenta-main-26 or >= orca-main-24, <= orca-main-24 or >= kayenta-main-25, <= kayenta-main-25 or >= echo-main-21, <= echo-main-21 or >= orca-main-23, <= orca-main-23 or >= kayenta-main-24, <= kayenta-main-24 or >= orca-main-22, <= orca-main-22 or >= kayenta-main-23, <= kayenta-main-23 or >= orca-main-21, <= orca-main-21 or >= kayenta-main-22, <= kayenta-main-22 or >= orca-main-20, <= orca-main-20 or >= kayenta-main-21, <= kayenta-main-21 or >= halyard-main-24, <= halyard-main-24 or >= clouddriver-main-24, <= clouddriver-main-24 or >= rosco-main-16, <= rosco-main-16 or >= orca-main-19, <= orca-main-19 or >= keel-main-16, <= keel-main-16 or >= kayenta-main-20, <= kayenta-main-20 or >= igor-main-21, <= igor-main-21 or >= halyard-main-23, <= halyard-main-23 or >= gate-main-20, <= gate-main-20 or >= front50-main-17, <= front50-main-17 or >= fiat-main-16, <= fiat-main-16 or >= echo-main-20, <= echo-main-20 or >= clouddriver-main-23, <= clouddriver-main-23 or >= orca-main-18, <= orca-main-18 or >= kayenta-main-19, <= kayenta-main-19 or >= echo-main-19, <= echo-main-19 or >= rosco-main-15, <= rosco-main-15 or >= orca-main-17, <= orca-main-17 or >= keel-main-15, <= keel-main-15 or >= kayenta-main-18, <= kayenta-main-18 or >= igor-main-20, <= igor-main-20 or >= halyard-main-22, <= halyard-main-22 or >= gate-main-19, <= gate-main-19 or >= front50-main-16, <= front50-main-16 or >= fiat-main-15, <= fiat-main-15 or >= echo-main-18, <= echo-main-18 or >= clouddriver-main-22, <= clouddriver-main-22 or >= rosco-main-14, <= rosco-main-14 or >= orca-main-16, <= orca-main-16 or >= keel-main-14, <= keel-main-14 or >= kayenta-main-17, <= kayenta-main-17 or >= igor-main-19, <= igor-main-19 or >= halyard-main-21, <= halyard-main-21 or >= gate-main-18, <= gate-main-18 or >= front50-main-15, <= front50-main-15 or >= fiat-main-14, <= fiat-main-14 or >= echo-main-17, <= echo-main-17 or >= clouddriver-main-21, <= clouddriver-main-21 or >= orca-main-15, <= orca-main-15 or >= keel-main-13, <= keel-main-13 or >= kayenta-main-16, <= kayenta-main-16 or >= igor-main-18, <= igor-main-18 or >= halyard-main-20, <= halyard-main-20 or >= gate-main-17, <= gate-main-17 or >= front50-main-14, <= front50-main-14 or >= fiat-main-13, <= fiat-main-13 or >= echo-main-16, <= echo-main-16 or >= clouddriver-main-20, <= clouddriver-main-20 or >= halyard-main-19, <= halyard-main-19 or >= clouddriver-main-19, <= clouddriver-main-19 or >= igor-main-17, <= igor-main-17 or >= gate-main-16, <= gate-main-16 or >= echo-main-15, <= echo-main-15 or >= halyard-main-18, <= halyard-main-18 or >= clouddriver-main-18, <= clouddriver-main-18 or >= rosco-main-12, <= rosco-main-12 or >= orca-main-14, <= orca-main-14 or >= keel-main-12, <= keel-main-12 or >= kayenta-main-15, <= kayenta-main-15 or >= igor-main-16, <= igor-main-16 or >= halyard-main-17, <= halyard-main-17 or >= gate-main-15, <= gate-main-15 or >= front50-main-13, <= front50-main-13 or >= fiat-main-12, <= fiat-main-12 or >= echo-main-14, <= echo-main-14 or >= clouddriver-main-17, <= clouddriver-main-17 or >= rosco-main-11, <= rosco-main-11 or >= orca-main-13, <= orca-main-13 or >= keel-main-11, <= keel-main-11 or >= kayenta-main-14, <= kayenta-main-14 or >= igor-main-15, <= igor-main-15 or >= halyard-main-16, <= halyard-main-16 or >= gate-main-14, <= gate-main-14 or >= front50-main-12, <= front50-main-12 or >= fiat-main-11, <= fiat-main-11 or >= echo-main-13, <= echo-main-13 or >= clouddriver-main-16, <= clouddriver-main-16 or >= rosco-main-10, <= rosco-main-10 or >= orca-main-12, <= orca-main-12 or >= keel-main-10, <= keel-main-10 or >= kayenta-main-13, <= kayenta-main-13 or >= igor-main-14, <= igor-main-14 or >= halyard-main-15, <= halyard-main-15 or >= gate-main-13, <= gate-main-13 or >= front50-main-11, <= front50-main-11 or >= fiat-main-10, <= fiat-main-10 or >= echo-main-12, <= echo-main-12 or >= clouddriver-main-15, <= clouddriver-main-15 or >= halyard-main-14, <= halyard-main-14 or >= front50-main-10, <= front50-main-10 or >= gate-main-12, <= gate-main-12 or >= gate-main-11, <= gate-main-11 or >= orca-main-11, <= orca-main-11 or >= kayenta-main-12, <= kayenta-main-12 or >= gate-main-10, <= gate-main-10 or >= halyard-main-13, <= halyard-main-13 or >= clouddriver-main-14, <= clouddriver-main-14 or >= rosco-main-9, <= rosco-main-9 or >= orca-main-10, <= orca-main-10 or >= keel-main-9, <= keel-main-9 or >= kayenta-main-11, <= kayenta-main-11 or >= igor-main-13, <= igor-main-13 or >= halyard-main-12, <= halyard-main-12 or >= gate-main-9, <= gate-main-9 or >= front50-main-9, <= front50-main-9 or >= fiat-main-9, <= fiat-main-9 or >= echo-main-11, <= echo-main-11 or >= clouddriver-main-13, <= clouddriver-main-13 or >= igor-main-12, <= igor-main-12 or >= rosco-main-8, <= rosco-main-8 or >= orca-main-9, <= orca-main-9 or >= keel-main-8, <= keel-main-8 or >= kayenta-main-10, <= kayenta-main-10 or >= igor-main-11, <= igor-main-11 or >= halyard-main-11, <= halyard-main-11 or >= gate-main-8, <= gate-main-8 or >= front50-main-8, <= front50-main-8 or >= fiat-main-8, <= fiat-main-8 or >= echo-main-10, <= echo-main-10 or >= clouddriver-main-12, <= clouddriver-main-12 or >= igor-main-10, <= igor-main-10 or >= halyard-main-10, <= halyard-main-10 or >= clouddriver-main-11, <= clouddriver-main-11 or >= kayenta-main-9, <= kayenta-main-9 or >= clouddriver-main-10, <= clouddriver-main-10 or >= rosco-main-6, <= rosco-main-6 or >= orca-main-7, <= orca-main-7 or >= keel-main-6, <= keel-main-6 or >= kayenta-main-7, <= kayenta-main-7 or >= igor-main-8, <= igor-main-8 or >= halyard-main-8, <= halyard-main-8 or >= gate-main-6, <= gate-main-6 or >= front50-main-6, <= front50-main-6 or >= fiat-main-6, <= fiat-main-6 or >= echo-main-8, <= echo-main-8 or >= clouddriver-main-9, <= clouddriver-main-9 or >= orca-main-6, <= orca-main-6 or >= kayenta-main-6, <= kayenta-main-6 or >= rosco-main-5, <= rosco-main-5 or >= orca-main-5, <= orca-main-5 or >= keel-main-5, <= keel-main-5 or >= kayenta-main-5, <= kayenta-main-5 or >= halyard-main-7, <= halyard-main-7 or >= gate-main-5, <= gate-main-5 or >= front50-main-5, <= front50-main-5 or >= fiat-main-5, <= fiat-main-5 or >= echo-main-7, <= echo-main-7 or >= clouddriver-main-8, <= clouddriver-main-8 or >= igor-main-6, <= igor-main-6 or >= halyard-main-6, <= halyard-main-6 or >= clouddriver-main-7, <= clouddriver-main-7 or >= rosco-main-4, <= rosco-main-4 or >= orca-main-4, <= orca-main-4 or >= keel-main-4, <= keel-main-4 or >= kayenta-main-4, <= kayenta-main-4 or >= igor-main-5, <= igor-main-5 or >= halyard-main-5, <= halyard-main-5 or >= gate-main-4, <= gate-main-4 or >= front50-main-4, <= front50-main-4 or >= fiat-main-4, <= fiat-main-4 or >= echo-main-6, <= echo-main-6 or >= clouddriver-main-6, <= clouddriver-main-6 or >= igor-main-4, <= igor-main-4 or >= halyard-main-4, <= halyard-main-4 or >= echo-main-5, <= echo-main-5 or >= deck-main-2, <= deck-main-2 or >= deck-kayenta-main-2, <= deck-kayenta-main-2 or >= bn-deck-kayenta-main-2, <= bn-deck-kayenta-main-2 or >= rosco-2025.0-0, <= rosco-2025.0-0 or >= orca-2025.0-0, <= orca-2025.0-0 or >= keel-2025.0-0, <= keel-2025.0-0 or >= kayenta-2025.0-0, <= kayenta-2025.0-0 or >= igor-2025.0-0, <= igor-2025.0-0 or >= halyard-2025.0-0, <= halyard-2025.0-0 or >= gate-2025.0-0, <= gate-2025.0-0 or >= front50-2025.0-0, <= front50-2025.0-0 or >= fiat-2025.0-0, <= fiat-2025.0-0 or >= echo-main-4, <= echo-main-4 or >= echo-2025.0-0, <= echo-2025.0-0 or >= clouddriver-2025.0-0, <= clouddriver-2025.0-0 or >= bn-spin-release-2025.0.x-0, <= bn-spin-release-2025.0.x-0 or >= bn-deck-release-2025.0.x-0, <= bn-deck-release-2025.0.x-0 or >= bn-deck-kayenta-release-2025.0.x-0, <= bn-deck-kayenta-release-2025.0.x-0 or >= rosco-main-3, <= rosco-main-3 or >= orca-main-3, <= orca-main-3 or >= keel-main-3, <= keel-main-3 or >= kayenta-main-3, <= kayenta-main-3 or >= igor-main-3, <= igor-main-3 or >= halyard-main-3, <= halyard-main-3 or >= gate-main-3, <= gate-main-3 or >= front50-main-3, <= front50-main-3 or >= fiat-main-3, <= fiat-main-3 or >= echo-main-3, <= echo-main-3 or >= clouddriver-main-5, <= clouddriver-main-5 or >= rosco-main-2, <= rosco-main-2 or >= orca-main-2, <= orca-main-2 or >= keel-main-2, <= keel-main-2 or >= kayenta-main-2, <= kayenta-main-2 or >= igor-main-2, <= igor-main-2 or >= halyard-main-2, <= halyard-main-2 or >= gate-main-2, <= gate-main-2 or >= front50-main-2, <= front50-main-2 or >= fiat-main-2, <= fiat-main-2 or >= echo-main-2, <= echo-main-2 or >= clouddriver-main-4, <= clouddriver-main-4 or >= spinnaker-release-2024.0.0, <= spinnaker-release-2024.0.0 or >= rosco-main-1, <= rosco-main-1 or >= orca-main-1, <= orca-main-1 or >= keel-main-1, <= keel-main-1 or >= kayenta-main-1, <= kayenta-main-1 or >= igor-main-1, <= igor-main-1 or >= halyard-main-1, <= halyard-main-1 or >= gate-main-1, <= gate-main-1 or >= front50-main-1, <= front50-main-1 or >= fiat-main-1, <= fiat-main-1 or >= echo-main-1, <= echo-main-1 or >= clouddriver-main-3, <= clouddriver-main-3 or >= clouddriver-main-2, <= clouddriver-main-2

Patched version

Not yet available

An early warning has been issued for a critical vulnerability in Spinnaker's clouddriver and orca components, which could allow URL validation bypass.

What happened

The vulnerability, tracked as CVE-2025-61916 and GHSA-8R8J-GFHG-FW38, involves Java URL objects not correctly handling underscores in hostnames. This issue reportedly allows a bypass of a previous CVE through the use of carefully crafted URLs. The vulnerability is under investigation and has not yet been confirmed as exploited in the wild.

Affected components include io.spinnaker.clouddriver:clouddriver-artifacts and io.spinnaker.orca:orca-core. The vulnerability affects specific version ranges of these components, as detailed in the threat data.

What to do about it

• Upgrade to versions 2025.4.1, 2025.3.1, 2025.2.4, or 2026.0.0 to mitigate the vulnerability.
• Review your Spinnaker deployment to identify if you are using affected versions of clouddriver-artifacts or orca-core.
• Monitor the primary sources for updates on the vulnerability and any official patches that may be released.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-8r8j-gfhg-fw38] Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames

Join the 0Day waitlist →

← Back to all threats