Linuxfoundation Spinnaker vulnerabilities

10 CVEs affecting Linuxfoundation Spinnaker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-55175, published 2026-07-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-43832, published 2022-01-04. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate…
CVE-2020-9301, published 2020-12-11. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of…
CVE-2026-55175, published 2026-07-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow…
CVE-2026-44795, published 2026-07-10. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using…
CVE-2026-32604, published 2026-04-20. Critical severity, CVSS 9.9. EPSS: 0.8% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the…
CVE-2026-32613, published 2026-04-20. Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected…
CVE-2022-23506, published 2023-01-03. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2,…
CVE-2023-39348, published 2023-08-28. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the…
CVE-2021-39143, published 2022-01-04. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract…
CVE-2025-61916, published 2026-01-05. Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days. Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing…