CVE-2026-25534

### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result. ### Patches This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0. ### Workarounds You can disable the various artifacts on this system to work around these limits.

• CWE-918

• https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25529Postal is an open source SMTP server. Postal versions less t…8.1
• CVE-2026-2553A security flaw has been discovered in tushar-2223 Hotel-Man…6.3
• CVE-2026-25530Kanboard is project management software focused on Kanban me…4.3
• CVE-2026-25531Kanboard is project management software focused on Kanban me…4.3
• CVE-2026-25532ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8
• CVE-2026-25533Enclave is a secure JavaScript sandbox designed for safe AI …8.8
• CVE-2026-25535jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2026-25536MCP TypeScript SDK is the official TypeScript SDK for Model …7.1
• CVE-2026-25537jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, …7.5
• CVE-2026-25538Devtron is an open source tool integration platform for Kube…8.8
• CVE-2026-25539SiYuan is a personal knowledge management system. Prior to v…7.2
• CVE-2026-2554The WCFM – Frontend Manager for WooCommerce along with Booki…8.1