Security Resilience

CVE-2026-25534

SSRF

SSRF
Published
17 March 2026
Modified
16 April 2026
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS Score 0.0042 35th percentile
Risk Priority 62 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-25534 is a critical-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-25534 is a URL validation bypass vulnerability in Netflix's Spinnaker platform, specifically affecting the clouddriver and Orca components. Spinnaker's updated URL validation logic for user-inputted URLs in clouddriver failed to properly handle underscores during parsing by Java URL objects, enabling a bypass of mitigations for the prior CVE-2025-61916 via crafted URLs. The issue also extends to Orca's existing fromUrl expression handling, impacting both artifacts and classified under CWE-918 (Server-Side Request Forgery).

Attackers with low privileges (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving scope-crossing effects (S:C). This yields high confidentiality impact (C:H), along with low integrity (I:L) and availability (I:L) impacts, for an overall CVSS v3.1 score of 9.1. Exploitation relies on supplying malicious URLs that evade sanitation, potentially allowing unauthorized actions tied to the bypassed prior vulnerability.

Patches addressing this vulnerability have been merged and are available in Spinnaker versions 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0. As a workaround, administrators can disable the affected clouddriver and Orca artifacts. Additional details are provided in GitHub security advisories GHSA-8r8j-gfhg-fw38 and GHSA-vrjc-q2fh-6x9h, as well as commit 7c4737906239a958a468e843239c6785b03d0eda.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the…

more

previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result. ### Patches This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0. ### Workarounds You can disable the various artifacts on this system to work around these limits.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1584 Compromise Infrastructure Resource Development
Adversaries may compromise third-party infrastructure that can be used during targeting.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-14627Shared CWE-918
CVE-2026-26286Shared CWE-918
CVE-2026-32301Shared CWE-918
CVE-2026-26120Shared CWE-918
CVE-2026-81357Shared CWE-918
CVE-2026-16600Shared CWE-918
CVE-2025-13393Shared CWE-918
CVE-2023-46746Shared CWE-918
CVE-2026-42140Shared CWE-918
CVE-2023-28288Shared CWE-918

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match

Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.

SI-10 Information Input Validation good match

Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.

SC-7 Boundary Protection partial match

Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure development practices directly include input validation and destination allow-listing that prevent SSRF.

DE.CM-09 partial match
blocks

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
blocks

Network segmentation and egress controls can limit the damage from successful SSRF requests.

References