CVE-2025-61916

{"id": "CVE-2025-61916", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61916", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T21:29:34.962525Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "spinnaker", "product": "spinnaker", "versions": [{"status": "affected", "version": "< 2025.1.6"}, {"status": "affected", "version": ">= 2025.2.0, < 2025.2.3"}]}]}], "published": "2026-01-05T22:15:50.610", "references": [{"url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-523"}, {"lang": "en", "value": "CWE-918"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into spinnaker pipelines via helm or other methods to extract things LIKE idmsv1 authentication data. This also includes calling internal spinnaker API's via a get and similar endpoints. Further, depending upon the artifact in question, auth data may be exposed to arbitrary endpoints (e.g. GitHub auth headers) leading to credentials exposure. To trigger this, a spinnaker installation MUST have two things. The first is an artifact enabled that allows user input. This includes GitHub file artifacts, BitBucket, GitLab, HTTP artifacts and similar artifact providers. JUST enabling the http artifact provider will add a \"no-auth\" http provider that could be used to extract link local data (e.g. AWS Metadata information). The second is a system that can consume the output of these artifacts. e.g. Rosco helm can use this to fetch values data. K8s account manifests if the API returns JSON can be used to inject that data into the pipeline itself though the pipeline would fail. This vulnerability is fixed in versions 2025.1.6, 2025.2.3, and 2025.3.0. As a workaround, disable HTTP account types that allow user input of a given URL. This is probably not feasible in most cases. Git, Docker and other artifact account types with explicit URL configurations bypass this limitation and should be safe as they limit artifact URL loading. Alternatively, use one of the various vendors which provide OPA policies to restrict pipelines from accessing or saving a pipeline with invalid URLs."}, {"lang": "es", "value": "Spinnaker es una plataforma de entrega continua de c\u00f3digo abierto y multinube. Las versiones anteriores a 2025.1.6, 2025.2.3 y 2025.3.0 son vulnerables a la falsificaci\u00f3n de petici\u00f3n del lado del servidor. El impacto principal es permitir a los usuarios obtener datos de una URL remota. Estos datos pueden ser inyectados en los pipelines de Spinnaker a trav\u00e9s de helm u otros m\u00e9todos para extraer cosas COMO datos de autenticaci\u00f3n idmsv1. Esto tambi\u00e9n incluye llamar a las API internas de Spinnaker a trav\u00e9s de un get y puntos finales similares. Adem\u00e1s, dependiendo del artefacto en cuesti\u00f3n, los datos de autenticaci\u00f3n pueden ser expuestos a puntos finales arbitrarios (p. ej., encabezados de autenticaci\u00f3n de GitHub) lo que lleva a la exposici\u00f3n de credenciales. Para activar esto, una instalaci\u00f3n de Spinnaker DEBE tener dos cosas. La primera es un artefacto habilitado que permite la entrada del usuario. Esto incluye artefactos de archivo de GitHub, BitBucket, GitLab, artefactos HTTP y proveedores de artefactos similares. SOLO habilitar el proveedor de artefactos http a\u00f1adir\u00e1 un proveedor http 'sin autenticaci\u00f3n' que podr\u00eda usarse para extraer datos locales de enlace (p. ej., informaci\u00f3n de metadatos de AWS). La segunda es un sistema que puede consumir la salida de estos artefactos. p. ej., Rosco helm puede usar esto para obtener datos de valores. Los manifiestos de cuenta de K8s, si la API devuelve JSON, pueden usarse para inyectar esos datos en el propio pipeline, aunque el pipeline fallar\u00eda. Esta vulnerabilidad est\u00e1 corregida en las versiones 2025.1.6, 2025.2.3 y 2025.3.0. Como soluci\u00f3n alternativa, deshabilite los tipos de cuenta HTTP que permiten la entrada del usuario de una URL dada. Esto probablemente no sea factible en la mayor\u00eda de los casos. Git, Docker y otros tipos de cuenta de artefactos con configuraciones de URL expl\u00edcitas evitan esta limitaci\u00f3n y deber\u00edan ser seguros ya que limitan la carga de URL de artefactos. Alternativamente, use uno de los varios proveedores que ofrecen pol\u00edticas OPA para restringir que los pipelines accedan o guarden un pipeline con URL no v\u00e1lidas."}], "lastModified": "2026-10-14T19:10:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C912D47-66A6-40EC-95BF-1091831BC7CF", "versionEndExcluding": "2025.1.6"}, {"criteria": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CAFD7A8-67A1-4E45-99CE-6FA31FA378B2", "versionEndExcluding": "2025.2.3", "versionStartIncluding": "2025.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}