CVE-2026-25534: 
Java vulnerability analysis and mitigation

CVE-2026-25534 is a Server-Side Request Forgery (SSRF) vulnerability in Spinnaker's clouddriver-artifacts and orca-core components, caused by a URL validation bypass via underscore characters in hostnames. It was published on March 16, 2026, and represents a bypass of the previously patched CVE-2025-61916. Affected versions include io.spinnaker.clouddriver:clouddriver-artifacts < 2025.2.4, >= 2025.3.0 and < 2025.3.1, >= 2025.4.0 and < 2025.4.1, and the same version ranges for io.spinnaker.orca:orca-core. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Spinnaker Advisory).

The root cause is improper input validation (CWE-20) leading to SSRF (CWE-918): Java's java.net.URI object returns null for getHost() when a hostname contains underscores, which caused the prior fix for CVE-2025-61916 to fall back to parsing the URL's authority component — a path that could be manipulated by an attacker. By crafting URLs such as https://example.com:badpassword@host_with_underscore.com, an attacker could cause the validator to extract the wrong host (e.g., the credential portion), bypassing allowlist checks in both HttpUrlRestrictions.validateURI() in clouddriver and UserConfiguredUrlRestrictions.validateURI() in Orca's fromUrl expression handling. The fix switches from java.net.URI to OkHttp's HttpUrl for host extraction, which correctly handles underscores (Spinnaker Advisory, Fix Commit).

A low-privileged authenticated attacker can exploit this vulnerability to make Spinnaker's clouddriver or Orca components issue HTTP requests to arbitrary internal or external destinations, bypassing configured URL allowlists. This can lead to exfiltration of sensitive data such as cloud provider credentials, AWS IMDSv1 metadata, or internal Spinnaker API responses, as well as potential injection of attacker-controlled data into pipelines (e.g., via Helm values). The changed scope means impact extends beyond the vulnerable component itself, potentially affecting other internal services reachable from the Spinnaker deployment (GitHub Advisory, Spinnaker Advisory).

1. Reconnaissance: Identify a Spinnaker deployment running a vulnerable version of clouddriver-artifacts or orca-core (< 2025.2.4, >= 2025.3.0 and < 2025.3.1, or >= 2025.4.0 and < 2025.4.1) with HTTP artifact providers or fromUrl expressions enabled.
2. Craft bypass URL: Construct a URL with an underscore in the target hostname and embed a credential-like string in the authority component to confuse the Java URI parser, e.g., https://allowed-domain.com:anypassword@internal_target_host.corp.
3. Submit malicious artifact URL: As an authenticated low-privileged user, submit the crafted URL as an artifact source (e.g., HTTP artifact, Helm values URL) or within an Orca pipeline fromUrl expression.
4. Trigger validation bypass: The validator extracts the host using java.net.URI.getHost(), which returns null for the underscore hostname; the fallback authority parsing then extracts allowed-domain.com (the credential portion), passing the allowlist check.
5. Achieve SSRF: Spinnaker fetches the content from the attacker-controlled internal target (e.g., http://169.254.169.254/latest/meta-data/ for AWS IMDSv1, or internal Spinnaker APIs), and the response may be injected into pipeline execution or returned to the attacker (Spinnaker Advisory, Fix Commit).

• Network: Outbound HTTP requests from Spinnaker clouddriver or Orca to internal IP ranges (e.g., 169.254.169.254, 10.x.x.x, 172.16.x.x) or unexpected external hosts; requests with hostnames containing underscores in Spinnaker service logs.
• Logs: Artifact fetch requests in clouddriver or Orca logs referencing URLs with underscore-containing hostnames or credential-embedded authority components (e.g., https://legit-domain.com:password@internal_host.corp); unexpected HTTP 200 responses from internal metadata endpoints.
• Pipeline Activity: Spinnaker pipeline executions referencing unusual fromUrl expressions or HTTP artifact URLs not matching established allowlists; pipeline data containing cloud provider metadata or internal API responses.

Spinnaker has released patched versions: clouddriver-artifacts and orca-core versions 2025.2.4, 2025.3.1, 2025.4.1, and 2026.0.0 (or 2026.1.0 per the security advisory). Upgrading to one of these versions is the recommended remediation. As a workaround, operators can disable artifact types that accept user-supplied URLs (e.g., HTTP artifact providers) and restrict access to Spinnaker services to only authorized users. Additionally, monitoring Spinnaker logs for URL patterns containing underscores in hostnames can serve as an interim detection measure (Spinnaker Advisory, GitHub Advisory).

The vulnerability was reported by jaydhulia and remediated by jasonmcintosh of the Spinnaker project, with the advisory published on March 16, 2026 (Spinnaker Advisory). Coverage appeared on The Hacker Wire shortly after disclosure (The Hacker Wire), and the vulnerability was noted in the Mastodon infosec community. No significant vendor statements beyond the official advisory or major analyst commentary have been identified.