Is CVE-2026-25534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25534 being exploited in the wild.

How severe is CVE-2026-25534?

Critical severity, with a CVSS score of 9.1, published 16 March 2026.

Which products and versions are affected?

io.spinnaker.clouddriver:clouddriver-artifacts (Maven) ECOSYSTEM:introduced=2025.1.6,fixed=2025.2.4; io.spinnaker.orca:orca-core (Maven) ECOSYSTEM:introduced=2025.1.6,fixed=2025.2.4; Netflix Clouddriver-Artifacts 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1; Netflix Orca-Core 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1.

How is CVE-2026-25534 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25534?

Check whether you run io.spinnaker.clouddriver:clouddriver-artifacts (Maven), io.spinnaker.orca:orca-core (Maven), Netflix Clouddriver-Artifacts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25534: Spinnaker clouddriver and orca URL validation bypass via underscores

Q: Is there a fix for CVE-2026-25534?

Yes. io.spinnaker.clouddriver:clouddriver-artifacts (Maven): upgrade to 2025.2.4 or later; io.spinnaker.orca:orca-core (Maven): upgrade to 2025.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-25534 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-25534?

Check whether you run io.spinnaker.clouddriver:clouddriver-artifacts (Maven), io.spinnaker.orca:orca-core (Maven), Netflix Clouddriver-Artifacts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25534 · Severity: critical · CVSS 9.1 · Published 2026-03-16

Spinnaker's clouddriver and orca components use URL validation to prevent malicious requests, but an oversight in how Java handles underscores in hostnames allows attackers to bypass these protections. An authenticated attacker with low privileges can craft specially crafted URLs containing underscores to reach unintended internal systems or resources, potentially exposing sensitive data or enabling further compromise of the deployment infrastructure.

Vendors: Maven.

Quick answers

Is CVE-2026-25534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25534 being exploited in the wild.
How severe is CVE-2026-25534?: Critical severity, with a CVSS score of 9.1, published 16 March 2026.
Which products and versions are affected?: io.spinnaker.clouddriver:clouddriver-artifacts (Maven) ECOSYSTEM:introduced=2025.1.6,fixed=2025.2.4; io.spinnaker.orca:orca-core (Maven) ECOSYSTEM:introduced=2025.1.6,fixed=2025.2.4; Netflix Clouddriver-Artifacts 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1; Netflix Orca-Core 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1.
Is there a fix for CVE-2026-25534?: Yes. io.spinnaker.clouddriver:clouddriver-artifacts (Maven): upgrade to 2025.2.4 or later; io.spinnaker.orca:orca-core (Maven): upgrade to 2025.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25534 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25534?: Check whether you run io.spinnaker.clouddriver:clouddriver-artifacts (Maven), io.spinnaker.orca:orca-core (Maven), Netflix Clouddriver-Artifacts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.spinnaker.clouddriver:clouddriver-artifacts (Maven): upgrade to 2025.2.4 or later

# set io.spinnaker.clouddriver:clouddriver-artifacts to 2025.2.4 in your pom.xml or build.gradle

io.spinnaker.orca:orca-core (Maven): upgrade to 2025.2.4 or later

# set io.spinnaker.orca:orca-core to 2025.2.4 in your pom.xml or build.gradle

Technical details

This vulnerability is a Server-Side Request Forgery (CWE-918) in Spinnaker's URL validation logic affecting both the clouddriver-artifacts and orca-core components. The root cause is that Java's URL class does not properly parse hostnames containing underscores—a character that is technically invalid in DNS but accepted by Java's URL parser. Spinnaker's previous attempt to sanitize user-supplied URLs (addressing CVE-2025-61916) missed this edge case. The flaw affects URL validation in clouddriver artifact handling and orca's fromUrl expression processing. An attacker with low-level authentication privileges and no user interaction required can exploit this over the network to make the server request URLs pointing to unexpected internal systems. Patches are available in versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0; vulnerable versions include 2025.3.0–2025.3.0, 2025.4.0–2025.4.0, and 2025.1.6–2025.2.3.

Affected products

Netflix/Spinnaker clouddriver-artifacts 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1
Netflix/Spinnaker orca-core 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1

Identifiers

CVE-2026-25534
GHSA-8r8j-gfhg-fw38

Timeline

2026-03-16: disclosed: Vulnerability disclosed via GitHub Advisory
2026-03-17: advisory: Published to National Vulnerability Database
2026-03-16: patched: Patches merged; available in versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.