The vulnerability is an input validation flaw that permits a malicious actor to specify arbitrary branch names and paths for gitrepo artifacts, enabling remote code execution on the clouddriver pods. An attacker who can configure such artifacts can run arbitrary shell commands, potentially exposing credentials, deleting files, or injecting additional resources. The flaw is a severe RCE (CWE‑20) with a CVSS score of 10, indicating full compromise of the affected instance.

All Spinnaker installations built with the open source Spinnaker platform in versions prior to 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2 are vulnerable. The vulnerability is fixed in releases 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2.

The CVSS score demonstrates maximum severity, while the EPSS score is not provided, leaving the likelihood of exploitation uncertain. The flaw is listed as not present in CISA KEV, indicating no actively exploited instances reported as of the last update. The attack vector is inferred to require an attacker who can inject configuration into a Spinnaker pipeline or artifact definition, typically through the UI or API, to supply malicious branch or path values; with such access, arbitrary commands can be executed on the underlying clouddriver pods.