This vulnerability arises from a flaw in Spinnaker’s URL validation logic, where Java URL objects fail to handle underscores in hostnames correctly. The result is a validation bypass that reproduces the conditions of the earlier CVE‑2025‑61916 and allows an attacker to supply crafted URLs that are treated as safe. The impact is a potential for arbitrary code execution or control over the Spinnaker deployment, as malicious URLs may be executed by the system when processed by clouddriver or orca.

Affected products include io.spinnaker.clouddriver:clouddriver-artifacts and io.spinnaker.orca:orca-core. The vulnerability affects all earlier releases and is fixed in 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0, so any instance running a version before these is vulnerable.

The vulnerability receives a CVSS score of 9.1, indicating a high risk of exploitation. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote, requiring an attacker to supply a malicious URL to a user‑facing endpoint; no local privilege escalation or other initial access requirements are noted in the provided description.