Executive brief
Spinnaker's clouddriver and orca components use URL validation to prevent malicious requests, but an oversight in how Java handles underscores in hostnames allows attackers to bypass these protections. An authenticated attacker with low privileges can craft specially crafted URLs containing underscores to reach unintended internal systems or resources, potentially exposing sensitive data or enabling further compromise of the deployment infrastructure.
Technical details
This vulnerability is a Server-Side Request Forgery (CWE-918) in Spinnaker's URL validation logic affecting both the clouddriver-artifacts and orca-core components. The root cause is that Java's URL class does not properly parse hostnames containing underscores—a character that is technically invalid in DNS but accepted by Java's URL parser. Spinnaker's previous attempt to sanitize user-supplied URLs (addressing CVE-2025-61916) missed this edge case. The flaw affects URL validation in clouddriver artifact handling and orca's fromUrl expression processing. An attacker with low-level authentication privileges and no user interaction required can exploit this over the network to make the server request URLs pointing to unexpected internal systems. Patches are available in versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0; vulnerable versions include 2025.3.0–2025.3.0, 2025.4.0–2025.4.0, and 2025.1.6–2025.2.3.
Affected products
- Netflix/Spinnaker clouddriver-artifacts 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1
- Netflix/Spinnaker orca-core 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1
Timeline
- 2026-03-16: disclosed: Vulnerability disclosed via GitHub Advisory
- 2026-03-17: advisory: Published to National Vulnerability Database
- 2026-03-16: patched: Patches merged; available in versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0