CVE Intelligence
Analysis AI-assisted

CVE-2026-25534: Spinnaker Clouddriver and Orca SSRF via URL validation bypass with underscores in hostnames

Spinnaker Clouddriver and Orca contain a URL validation bypass that relies on underscores in hostnames, which Java URL parsing does not handle correctly. The advisory says this also bypasses the earlier fix for CVE-2025-61916 and affects Orca fromUrl expression handling. Fixed releases are named in the advisory, and the record's CVSS base score is 9.1 (critical).

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Spinnaker Clouddriver and Orca received a new URL validation check, but the check can be bypassed because Java URL objects do not correctly handle underscores in hostnames during parsing. The advisory says this bypasses the earlier fix for CVE-2025-61916 and also affects the existing URL validations in Orca fromUrl expression handling.

Impact

  • The weakness is classified as CWE-918 (Server-Side Request Forgery).
  • The record lists a CVSS base score of 9.1 (critical), reported by the GitHub CNA.
  • The advisory states that both the Clouddriver and Orca artifacts are affected.

Affected products and versions

  • Io.spinnaker.clouddriver Clouddriver-artifacts: before 2025.2.4; from 2025.3.0 up to before 2025.3.1; from 2025.4.0 up to before 2025.4.1.
  • Io.spinnaker.orca Orca-core: the same ranges as above.
  • The advisory names 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0 as releases that include the merged fix. The record's structured fixes list is empty, so confirm the exact mapping in the advisory.

Exploitation status

The record does not list this CVE in CISA KEV. The SSVC exploitation value is none and the EPSS probability is 0.00421. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Clouddriver and Orca to a fixed release from the advisory, using the release line that matches your deployment.
  • The advisory suggests disabling the affected artifacts on the system as a workaround. The record does not state how completely this removes exposure, so treat it as temporary.
  • Review whether URL-based artifact or fromUrl features are reachable by untrusted users.

Detection guidance

  • Review logs for outbound requests from Clouddriver or Orca to internal or unexpected hosts, especially hostnames containing underscores.
  • Monitor for unusual service-side requests to cloud metadata or internal addresses originating from these services.

Limitations of the available information

  • The record gives no public exploit details and no exploitation telemetry beyond EPSS and SSVC.
  • The structured fixes field is empty, so the fixed-version mapping relies on the advisory text.
  • The record does not say how many deployments use the affected artifacts or Orca fromUrl expressions.

Frequently asked questions

What is the root cause of CVE-2026-25534?

According to the advisory, Java URL objects do not handle underscores in hostnames correctly during parsing, so the new URL validation can be bypassed.

Which components are affected?

The record lists Io.spinnaker.clouddriver Clouddriver-artifacts and Io.spinnaker.orca Orca-core, with ranges before 2025.2.4, from 2025.3.0 up to before 2025.3.1, and from 2025.4.0 up to before 2025.4.1.

Is this vulnerability known to be exploited in the wild?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

What should administrators do now?

Upgrade to a fixed release named in the advisory for your release line. If that is not possible, the advisory suggests disabling the affected artifacts as a temporary workaround.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.