CVE-2025-61916 (CNNVD-202601-818)

HIGH
中文标题:
Spinnaker 代码问题漏洞
英文标题:
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
CVSS分数: 7.9
发布时间: 2026-01-05 21:14:36
漏洞类型: 代码问题
状态: PUBLISHED
数据质量分数: 0.40
数据版本: v3
漏洞描述
中文描述:

Spinnaker是Spinnaker开源的一个持续交付平台。用于以高速度和高信心发布软件更改。 Spinnaker 2025.1.6之前版本、2025.2.3之前版本和2025.3.0之前版本存在代码问题漏洞，该漏洞源于存在服务端请求伪造，可能导致凭据泄露。

英文描述:

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into spinnaker pipelines via helm or other methods to extract things LIKE idmsv1 authentication data. This also includes calling internal spinnaker API's via a get and similar endpoints. Further, depending upon the artifact in question, auth data may be exposed to arbitrary endpoints (e.g. GitHub auth headers) leading to credentials exposure. To trigger this, a spinnaker installation MUST have two things. The first is an artifact enabled that allows user input. This includes GitHub file artifacts, BitBucket, GitLab, HTTP artifacts and similar artifact providers. JUST enabling the http artifact provider will add a "no-auth" http provider that could be used to extract link local data (e.g. AWS Metadata information). The second is a system that can consume the output of these artifacts. e.g. Rosco helm can use this to fetch values data. K8s account manifests if the API returns JSON can be used to inject that data into the pipeline itself though the pipeline would fail. This vulnerability is fixed in versions 2025.1.6, 2025.2.3, and 2025.3.0. As a workaround, disable HTTP account types that allow user input of a given URL. This is probably not feasible in most cases. Git, Docker and other artifact account types with explicit URL configurations bypass this limitation and should be safe as they limit artifact URL loading. Alternatively, use one of the various vendors which provide OPA policies to restrict pipelines from accessing or saving a pipeline with invalid URLs.

CWE类型:
CWE-918 CWE-20 CWE-523
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
spinnaker spinnaker < 2025.1.6 - - cpe:2.3:a:spinnaker:spinnaker:<_2025.1.6:*:*:*:*:*:*:*
spinnaker spinnaker >= 2025.2.0, < 2025.2.3 - - cpe:2.3:a:spinnaker:spinnaker:>=_2025.2.0,_<_2025.2.3:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h x_refsource_CONFIRM
cve.org
访问
CVSS评分详情
3.1 (cna)
HIGH
7.9
CVSS向量: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
机密性
HIGH
完整性
LOW
可用性
LOW
时间信息
发布时间:
2026-01-05 21:14:36
修改时间:
2026-01-05 21:30:01
创建时间:
2026-01-12 02:12:11
更新时间:
2026-01-19 09:29:44
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2025-61916 2026-01-07 02:47:01 2026-01-12 02:12:11
NVD nvd_CVE-2025-61916 2026-01-09 03:00:07 2026-01-12 02:27:56
CNNVD cnnvd_CNNVD-202601-818 2026-01-11 06:15:07 2026-01-12 02:38:16
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2026-01-12 02:38:16
vulnerability_type: 未提取 → 代码问题; cnnvd_id: 未提取 → CNNVD-202601-818; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 代码问题
  • cnnvd_id: 未提取 -> CNNVD-202601-818
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2026-01-12 02:27:56
data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • data_sources: ['cve'] -> ['cve', 'nvd']