Server-Side Request Forgery in Spinnaker by Armory

CVE-2025-61916

What is CVE-2025-61916?

Spinnaker, as an open-source continuous delivery platform, is affected by a server-side request forgery vulnerability that arises in versions prior to 2025.1.6, 2025.2.3, and 2025.3.0. This vulnerability allows users to exploit the platform to retrieve data from a remote URL, which may lead to the injection of sensitive information into Spinnaker pipelines through methods such as Helm. Users could inadvertently expose authentication data, including GitHub auth headers, to unauthorized endpoints. A successful exploit necessitates the enabling of user-input-enabled artifacts, including HTTP artifacts, which can result in retrieval of sensitive link-local data, such as AWS metadata. It is essential to implement mitigations such as disabling HTTP account types that allow user inputs or utilizing security policies to limit access to pipeline configurations. The vulnerability is addressed in the mentioned versions.

References