A high-severity SSRF vulnerability in Spinnaker allows authenticated local users to exfiltrate sensitive credential data and interact with internal APIs, posing a significant risk to cloud infrastructure.

This vulnerability involves improper input validation (CWE-20) leading to Server-Side Request Forgery (CWE-918), where authenticated users can leverage artifact providers to fetch data from remote URLs or internal endpoints. The flaw can be triggered when artifact providers (such as GitHub, GitLab, or HTTP) are enabled and configured to process user input.

Successful exploitation allows an attacker to bypass internal network boundaries to access sensitive metadata, such as AWS instance metadata or internal Spinnaker API endpoints. Furthermore, the vulnerability can lead to the exposure of authentication tokens and headers, which may grant an attacker elevated access to downstream integrated services, resulting in potential compromise of the entire continuous delivery pipeline. The CVSS score of 7.9 reflects a high risk to confidentiality and integrity within the deployment environment.

Immediate Action: Upgrade to Spinnaker versions 2025.1.6 or 2025.2.3, or later, as provided in the official vendor advisory to resolve the underlying input validation flaws.

Proactive Monitoring: Monitor access logs and artifact fetch requests for unusual URL patterns, particularly those targeting internal IP addresses (e.g., 169.254.169.254) or unexpected external domains.

Compensating Controls: Restrict artifact provider configurations to trusted internal sources and implement strict egress filtering at the network level to prevent Spinnaker instances from reaching unauthorized internal or external endpoints.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate attention, as it provides a direct path to credential theft and internal reconnaissance within the CI/CD environment. Administrators must prioritize patching to the specified fixed versions to eliminate the SSRF vector and prevent unauthorized access to sensitive authentication data.