High · published January 6, 2026
⚡ A crafty server-side request forgery lurking in Spinnaker could let attackers fetch sensitive data without breaking a sweat! 🚨 Think of this vulnerability like leaving the curtains open while someone outside can call into your home and ask for your valuables. If you let them in, they can access anything you’ve carelessly left exposed! An attacker could exploit this vulnerability to gain access to sensitive authentication data, such as GitHub credentials, and potentially call internal APIs. This could lead to a snowball effect of unauthorized access, putting your entire CI/CD pipeline at risk!
Think of this vulnerability like leaving the curtains open while someone outside can call into your home and ask for your valuables. If you let them in, they can access anything you’ve carelessly left exposed! CVE-2025-61916 allows users to fetch data from remote URLs via user-input artifacts in Spinnaker, potentially exposing sensitive information through API calls and data injections.
An attacker could exploit this vulnerability to gain access to sensitive authentication data, such as GitHub credentials, and potentially call internal APIs. This could lead to a snowball effect of unauthorized access, putting your entire CI/CD pipeline at risk! Upgrade your Spinnaker installation to versions 2025.1.6, 2025.2.3, or 2025.3.0 to patch this vulnerability. As a temporary measure, consider disabling HTTP account types that allow user input URLs, or implement OPA policies to restrict invalid pipeline URLs. Stay vigilant! You’ve got this! Follow these steps to secure your Spinnaker installations and keep your pipelines safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| linuxfoundation/spinnaker | < 2025.1.6 | 2025.1.6 |
| linuxfoundation/spinnaker | ≥ 2025.2.0, < 2025.2.3 | 2025.2.3 |