Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
Priority MEDIUM 42CWE-470Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01012 63rd percentileScored 2026-11-07
Fix Fixed spinnaker (spinnaker): 2025.4.4, 2026.0.3, 2025.3.3io.spinnaker.rosco:rosco-core (Maven): 2025.3.3, 2025.4.4, 2026.0.3+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| spinnaker | spinnaker | 2025.4.0 to before 2025.4.4; 2026.0.0 to before 2026.0.3; before 2025.3.3 | 2025.4.4, 2026.0.3, 2025.3.3 | Patch available | CNA |
| — | io.spinnaker.rosco:rosco-core (Maven) | before 2025.3.3 | 2025.3.3 | Patch available | GHSA-c8q4-9h32-2ww8 |
| — | io.spinnaker.orca:orca-core (Maven) | before 2025.3.3 | 2025.3.3 | Patch available | GHSA-c8q4-9h32-2ww8 |
| — | io.spinnaker.rosco:rosco-core (Maven) | 2025.4.0 to before 2025.4.4 | 2025.4.4 | Patch available | GHSA-c8q4-9h32-2ww8 |
| — | io.spinnaker.rosco:rosco-core (Maven) | 2026.0.0 to before 2026.0.3 | 2026.0.3 | Patch available | GHSA-c8q4-9h32-2ww8 |
| — | io.spinnaker.orca:orca-core (Maven) | 2025.4.0 to before 2025.4.4 | 2025.4.4 | Patch available | GHSA-c8q4-9h32-2ww8 |
| — | io.spinnaker.orca:orca-core (Maven) | 2026.0.0 to before 2026.0.3 | 2026.0.3 | Patch available | GHSA-c8q4-9h32-2ww8 |
- spinnaker Vendorspinnaker Affected 2025.4.0 to before 2025.4.4; 2026.0.0 to before 2026.0.3; before 2025.3.3 Fixed in 2025.4.4, 2026.0.3, 2025.3.3 Patch available CNA
- io.spinnaker.rosco:rosco-core (Maven) Vendor— Affected before 2025.3.3 Fixed in 2025.3.3 Patch available GHSA-c8q4-9h32-2ww8
- io.spinnaker.orca:orca-core (Maven) Vendor— Affected before 2025.3.3 Fixed in 2025.3.3 Patch available GHSA-c8q4-9h32-2ww8
- io.spinnaker.rosco:rosco-core (Maven) Vendor— Affected 2025.4.0 to before 2025.4.4 Fixed in 2025.4.4 Patch available GHSA-c8q4-9h32-2ww8
- io.spinnaker.rosco:rosco-core (Maven) Vendor— Affected 2026.0.0 to before 2026.0.3 Fixed in 2026.0.3 Patch available GHSA-c8q4-9h32-2ww8
- io.spinnaker.orca:orca-core (Maven) Vendor— Affected 2025.4.0 to before 2025.4.4 Fixed in 2025.4.4 Patch available GHSA-c8q4-9h32-2ww8
- io.spinnaker.orca:orca-core (Maven) Vendor— Affected 2026.0.0 to before 2026.0.3 Fixed in 2026.0.3 Patch available GHSA-c8q4-9h32-2ww8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* | before 2025.3.3; 2025.4.0 to before 2025.4.4; 2026.0.0 to before 2026.0.3 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* Versions before 2025.3.3; 2025.4.0 to before 2025.4.4; 2026.0.0 to before 2026.0.3 Vulnerable ·backstage
Remediation
- Fix · CNA spinnaker (spinnaker) Fixed in 2025.4.4, 2026.0.3, 2025.3.3
- Fix · GHSA-c8q4-9h32-2ww8 io.spinnaker.rosco:rosco-core (Maven) Fixed in 2025.3.3 Advisory →
- Fix · GHSA-c8q4-9h32-2ww8 io.spinnaker.orca:orca-core (Maven) Fixed in 2025.3.3 Advisory →
- Fix · GHSA-c8q4-9h32-2ww8 io.spinnaker.rosco:rosco-core (Maven) Fixed in 2025.4.4 Advisory →
- Fix · GHSA-c8q4-9h32-2ww8 io.spinnaker.rosco:rosco-core (Maven) Fixed in 2026.0.3 Advisory →
- Fix · GHSA-c8q4-9h32-2ww8 io.spinnaker.orca:orca-core (Maven) Fixed in 2025.4.4 Advisory →
- Fix · GHSA-c8q4-9h32-2ww8 io.spinnaker.orca:orca-core (Maven) Fixed in 2026.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44795
- 2026-10-03 Alias added: GHSA-c8q4-9h32-2ww8
References
Patch 3
Advisory 2
More spinnaker vulnerabilities
- TI-2021-16529 Path Traversal in spinnaker CVSS 3.1HIGH 7.1
- TI-2021-19638 Improper Access Control in spinnaker CVSS 3.1CRITICAL 10.0
- TI-2026-25122 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling CVSS 3.1CRITICAL 10.0
- TI-2026-25113 Improper input validation in spinnaker CVSS 3.1CRITICAL 10.0
- TI-2026-39859 Spinnaker: Improper yaml processing on kustomize bake operations CVSS 3.1HIGH 7.5
- TI-2020-07437 Server-side request forgery in Netflix Orca Spinnaker CVSS 3.1HIGH 7.5
Sources
- CVE-2026-44795 · CVE Program
- CVE-2026-44795 · NVD
- FIRST EPSS
- GHSA-c8q4-9h32-2ww8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences