# CVE-2026-32604: Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

Source: https://junglewise.ai/threats/cve-2026-32604-spinnaker-rce-when-using-gitrepo-artifact-types-due-to-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-32604 · Severity: critical · CVSS 9.9 · Published 2026-04-20

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.

Technologies: [Linuxfoundation Spinnaker](https://junglewise.ai/threats/technologies/linuxfoundation-spinnaker). Vendors: [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-32604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32604 being exploited in the wild.

**How severe is CVE-2026-32604?** Critical severity, with a CVSS score of 9.9, published 20 April 2026.

**Which products and versions are affected?** io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) < 2026.0.1, ECOSYSTEM:introduced=0,fixed=2026.0.1.

**Is there a fix for CVE-2026-32604?** Yes. io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven): upgrade to 2026.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-32604?** Check whether you run Linuxfoundation Spinnaker or io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven): upgrade to 2026.0.1 or later

  ```sh
  # set io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo to 2026.0.1 in your pom.xml or build.gradle
  ```


## Affected products

- Linuxfoundation Spinnaker
- io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo (Maven) < 2026.0.1, ECOSYSTEM:introduced=0,fixed=2026.0.1

## Identifiers

- CVE-2026-32604
- GHSA-x3j7-7pgj-h87r

## References

- [https://api.github.com/users/LeftenantZero](https://api.github.com/users/LeftenantZero)
- [https://github.com/LeftenantZero](https://github.com/LeftenantZero)
- [https://api.github.com/users/LeftenantZero/gists%7B/gist_id%7D](https://api.github.com/users/LeftenantZero/gists%7B/gist_id%7D)
- [https://api.github.com/users/LeftenantZero/repos](https://api.github.com/users/LeftenantZero/repos)
- [https://avatars.githubusercontent.com/u/632716?v=4](https://avatars.githubusercontent.com/u/632716?v=4)
- [https://api.github.com/users/LeftenantZero/events%7B/privacy%7D](https://api.github.com/users/LeftenantZero/events%7B/privacy%7D)

## Related threats

- [Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language)](https://junglewise.ai/threats/cve-2026-32613-spinnaker-rce-via-expression-parsing-due-to-unrestricted-context)
- [Spinnaker vulnerable to SSRF due to improper restrictions on http from user input](https://junglewise.ai/threats/cve-2025-61916-spinnaker-vulnerable-to-ssrf-due-to-improper-restrictions-on-http)