Arbitrary Java Class Access in Spinnaker by Armory

CVE-2026-32613

What is CVE-2026-32613?

A vulnerability in Spinnaker allows unauthorized access to system resources via the Spring Expression Language (SpEL). Prior to versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, the Echo service did not restrict access to a trusted set of classes, facilitating the execution of arbitrary Java commands. This can lead to command invocation, file access, and deeper system penetration. Users are advised to upgrade to patched versions or disable the Echo service as an immediate workaround.

References