Arbitrary Command Execution Vulnerability in Spinnaker by Armory
CVE-2026-32604
Key Information:
Badges
What is CVE-2026-32604?
Spinnaker, a multi-cloud continuous delivery platform, is vulnerable to arbitrary command execution in specific versions. An attacker can exploit this vulnerability by executing arbitrary commands on clouddriver pods. This could lead to credential exposure, file deletion, or unauthorized resource injection. Users are advised to upgrade to patched versions 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2, and consider disabling gitrepo artifact types as an additional workaround.
Affected Version(s)
spinnaker < 2026.0.1 < 2026.0.1
spinnaker < 2025.4.2 < 2025.4.2
spinnaker < 2025.3.2 < 2025.3.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.