Horizon Alert
Summary of the vulnerability and why it matters
A critical security flaw in the Spinnaker continuous delivery platform allows an attacker to execute arbitrary code on the system. This issue exists because a component named Echo incorrectly trusted user-provided input, enabling deep system access. This could lead to unauthorized command execution or data compromise.
- Affected systems could be controlled.
- Sensitive data may be exposed.
- Requires existing access.
Attack Path
How an attacker could exploit the issue
An authenticated attacker with low privileges can exploit this vulnerability by crafting malicious SpEL expressions within Spinnaker's Echo service. This allows them to execute arbitrary Java code on the server, granting them deep system access to invoke commands or read files.
- Requires authenticated access.
- Targets Echo service with SpEL.
- Affects Spinnaker prior to patched versions.
Live Threat
Current exploitation, exposure, and threat context
This Spinnaker vulnerability allows for full JVM access via SPeL injection in the Echo service, enabling arbitrary command execution and file access. While technically a critical vulnerability, its weaponization likelihood is tempered by Spinnaker's typical deployment environment and audience. Attackers may find it less attractive for widespread exploitation due to its niche use and the technical expertise required to target it effectively, though it presents a significant risk to organizations using the affected versions.
- Primarily internal target audience.
- Exploits require specific Spinnaker configuration.
- No current public exploit or KEV listing.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching or updating Spinnaker to a fixed version to address the critical SpEL injection vulnerability. If immediate patching is not feasible due to operational constraints, disabling the Echo component serves as an effective workaround to mitigate the risk of arbitrary code execution.
- Patch Spinnaker to 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2.
- Disable the Echo component as a workaround.
- Monitor for unexpected Echo service activity.
