Spinnaker Echo Spring Expression Language Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Spinnaker Echo versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2. The issue arises because Echo, unlike other Spinnaker services, does not restrict Spring Expression Language (SPeL) context to trusted classes, allowing full access to the Java Virtual Machine (JVM). This lack of restriction enables users to invoke arbitrary Java classes, potentially leading to execution of commands, access to files, and other system-level actions.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Spinnaker Echo is running.

Remediation

Users can upgrade to Spinnaker Echo versions 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2 to address this vulnerability. Alternatively, Echo can be disabled entirely.