# CVE-2026-25534: Spinnaker clouddriver and orca URL validation bypass via underscores

Source: https://junglewise.ai/threats/cve-2026-25534-spinnaker-clouddriver-and-orca-url-validation-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25534 · Severity: critical · CVSS 9.1 · Published 2026-03-16

Spinnaker's clouddriver and orca components use URL validation to prevent malicious requests, but an oversight in how Java handles underscores in hostnames allows attackers to bypass these protections. An authenticated attacker with low privileges can craft specially crafted URLs containing underscores to reach unintended internal systems or resources, potentially exposing sensitive data or enabling further compromise of the deployment infrastructure.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-25534 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25534 being exploited in the wild.

**How severe is CVE-2026-25534?** Critical severity, with a CVSS score of 9.1, published 16 March 2026.

**Which products and versions are affected?** io.spinnaker.clouddriver:clouddriver-artifacts (Maven) ECOSYSTEM:introduced=2025.1.6,fixed=2025.2.4; io.spinnaker.orca:orca-core (Maven) ECOSYSTEM:introduced=2025.1.6,fixed=2025.2.4; Netflix Clouddriver-Artifacts 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1; Netflix Orca-Core 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1.

**Is there a fix for CVE-2026-25534?** Yes. io.spinnaker.clouddriver:clouddriver-artifacts (Maven): upgrade to 2025.2.4 or later; io.spinnaker.orca:orca-core (Maven): upgrade to 2025.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25534 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25534?** Check whether you run io.spinnaker.clouddriver:clouddriver-artifacts (Maven), io.spinnaker.orca:orca-core (Maven), Netflix Clouddriver-Artifacts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.spinnaker.clouddriver:clouddriver-artifacts (Maven): upgrade to 2025.2.4 or later

  ```sh
  # set io.spinnaker.clouddriver:clouddriver-artifacts to 2025.2.4 in your pom.xml or build.gradle
  ```

- io.spinnaker.orca:orca-core (Maven): upgrade to 2025.2.4 or later

  ```sh
  # set io.spinnaker.orca:orca-core to 2025.2.4 in your pom.xml or build.gradle
  ```


## Technical details

This vulnerability is a Server-Side Request Forgery (CWE-918) in Spinnaker's URL validation logic affecting both the clouddriver-artifacts and orca-core components. The root cause is that Java's URL class does not properly parse hostnames containing underscores—a character that is technically invalid in DNS but accepted by Java's URL parser. Spinnaker's previous attempt to sanitize user-supplied URLs (addressing CVE-2025-61916) missed this edge case. The flaw affects URL validation in clouddriver artifact handling and orca's fromUrl expression processing. An attacker with low-level authentication privileges and no user interaction required can exploit this over the network to make the server request URLs pointing to unexpected internal systems. Patches are available in versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0; vulnerable versions include 2025.3.0–2025.3.0, 2025.4.0–2025.4.0, and 2025.1.6–2025.2.3.

## Affected products

- Netflix/Spinnaker clouddriver-artifacts 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1
- Netflix/Spinnaker orca-core 2025.1.6 to <2025.2.4, 2025.3.0 to <2025.3.1, 2025.4.0 to <2025.4.1

## Identifiers

- CVE-2026-25534
- GHSA-8r8j-gfhg-fw38

## Timeline

- 2026-03-16: disclosed: Vulnerability disclosed via GitHub Advisory
- 2026-03-17: advisory: Published to National Vulnerability Database
- 2026-03-16: patched: Patches merged; available in versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0

## References

- [https://api.github.com/users/jaydhulia](https://api.github.com/users/jaydhulia)
- [https://github.com/jaydhulia](https://github.com/jaydhulia)
- [https://api.github.com/users/jaydhulia/gists%7B/gist_id%7D](https://api.github.com/users/jaydhulia/gists%7B/gist_id%7D)
- [https://api.github.com/users/jaydhulia/repos](https://api.github.com/users/jaydhulia/repos)
- [https://avatars.githubusercontent.com/u/46459060?v=4](https://avatars.githubusercontent.com/u/46459060?v=4)
- [https://api.github.com/users/jaydhulia/events%7B/privacy%7D](https://api.github.com/users/jaydhulia/events%7B/privacy%7D)

## Related threats

- [Spinnaker RCE via unsafe YAML deserialization](https://junglewise.ai/threats/cve-2026-44795-spinnaker-rce-via-unsafe-yaml-deserialization)
- [Spinnaker vulnerable to SSRF due to improper restrictions on http from user input](https://junglewise.ai/threats/cve-2025-61916-spinnaker-vulnerable-to-ssrf-due-to-improper-restrictions-on-http)