PT-2026-1334 · Gitlab+4 · Gitlab+4

Published 2026-01-05 · Updated 2026-02-23 · CVE-2025-61916

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2025.1.6 Spinnaker versions prior to 2025.2.3 Spinnaker versions prior to 2025.3.0

Description Spinnaker, an open source, multi-cloud continuous delivery platform, is susceptible to server-side request forgery. This allows users to fetch data from a remote URL, potentially injecting it into Spinnaker pipelines via tools like helm. This can lead to the exposure of sensitive data, including authentication information (like idmsv1 authentication data and GitHub auth headers) and access to internal Spinnaker APIs via GET requests. The issue requires a Spinnaker installation with an artifact enabled that accepts user input, such as GitHub file artifacts, BitBucket, GitLab, or HTTP artifacts. A system capable of consuming the output of these artifacts is also necessary. The vulnerability is triggered when an artifact fetches data from a URL and that data is then used within the pipeline.

Recommendations Versions prior to 2025.1.6 should be updated to version 2025.1.6 or later. Versions prior to 2025.2.3 should be updated to version 2025.2.3 or later. Versions prior to 2025.3.0 should be updated to version 2025.3.0 or later. Disable HTTP account types that allow user input of a given URL. Utilize Open Policy Agent (OPA) policies to restrict pipelines from accessing or saving pipelines with invalid URLs.

Exploit

Fix

RCE

SSRF

Weakness Enumeration

CWE-20

CWE-918

CWE-523

Related Identifiers

CVE-2025-61916

GHSA-VRJC-Q2FH-6X9H

Affected Products

Bitbucket

Github

Gitlab

Open Policy Agent

Spinnaker

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61916.json · Exploit
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61916 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61916 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrjc-q2fh-6x9h · Vendor Advisory
• https://github.com/spinnaker/spinnaker · Note
• https://t.me/cveNotify/152919 · Telegram Post
• https://twitter.com/CVEnew/status/2008346559562608797 · Twitter Post
• https://t.me/CVEtracker/41423 · Telegram Post