Is CVE-2026-32604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32604 being exploited in the wild.

How severe is CVE-2026-32604?

Critical severity, with a CVSS score of 9.9, published 20 April 2026.

Which products and versions are affected?

io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) < 2026.0.1, ECOSYSTEM:introduced=0,fixed=2026.0.1.

Is there a fix for CVE-2026-32604?

Yes. io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven): upgrade to 2026.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-32604?

Check whether you run Linuxfoundation Spinnaker or io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32604: Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

Q: Is there a fix for CVE-2026-32604?

Yes. io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven): upgrade to 2026.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: Am I affected by CVE-2026-32604?

Check whether you run Linuxfoundation Spinnaker or io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32604 · Severity: critical · CVSS 9.9 · Published 2026-04-20

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

Technologies: Linuxfoundation Spinnaker. Vendors: Linuxfoundation, Maven.

Quick answers

Is CVE-2026-32604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32604 being exploited in the wild.
How severe is CVE-2026-32604?: Critical severity, with a CVSS score of 9.9, published 20 April 2026.
Which products and versions are affected?: io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) < 2026.0.1, ECOSYSTEM:introduced=0,fixed=2026.0.1.
Is there a fix for CVE-2026-32604?: Yes. io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven): upgrade to 2026.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-32604?: Check whether you run Linuxfoundation Spinnaker or io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven): upgrade to 2026.0.1 or later

# set io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo to 2026.0.1 in your pom.xml or build.gradle

Affected products

Linuxfoundation Spinnaker
io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) < 2026.0.1, ECOSYSTEM:introduced=0,fixed=2026.0.1

Identifiers

CVE-2026-32604
GHSA-x3j7-7pgj-h87r

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.