CVE-2026-32613: Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
Impact Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. Unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enables a user to use arbitrary java classes which allow deep access to the system. This enables the ability to invoke commands, access files, etc.
Workarounds Disable echo entirely.
Other sources
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32613?
CVE-2026-32613 is rated as a critical vulnerability due to its potential to allow remote code execution.
How can I mitigate the risks associated with CVE-2026-32613?
To mitigate CVE-2026-32613, it is recommended to upgrade Spinnaker Echo to the latest version that addresses the vulnerability.
Which versions of Spinnaker Echo are affected by CVE-2026-32613?
CVE-2026-32613 affects Spinnaker Echo versions up to but not including 2026.1.0, 2026.0.1, and 2025.4.2, 2025.3.2.
What type of vulnerability is CVE-2026-32613?
CVE-2026-32613 is a remote code execution (RCE) vulnerability stemming from unrestricted context handling in expression parsing.
What is the main cause of CVE-2026-32613?
The main cause of CVE-2026-32613 is the use of Spring Expression Language (SPeL) in Spinnaker Echo without sufficient restrictions on context handling.