Spinnaker: Improper yaml processing on kustomize bake operations
Priority LOW 37CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01057 64th percentileScored 2026-11-07
Fix Fixed spinnaker (spinnaker): 2026.1.1, 2026.0.3, 2025.4.4 +1io.spinnaker.rosco:rosco-manifests (Maven): 2025.3.4, 2025.4.4, 2026.0.3 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| spinnaker | spinnaker | 2026.1.0 to before 2026.1.1; 2026.0.0 to before 2026.0.3; 2025.4.0 to before 2025.4.4; before 2025.3.4 | 2026.1.1, 2026.0.3, 2025.4.4, 2025.3.4 | Patch available | CNA |
| — | io.spinnaker.rosco:rosco-manifests (Maven) | before 2025.3.4 | 2025.3.4 | Patch available | GHSA-p68j-q7hf-3qcp |
| — | io.spinnaker.rosco:rosco-manifests (Maven) | 2025.4.0 to before 2025.4.4 | 2025.4.4 | Patch available | GHSA-p68j-q7hf-3qcp |
| — | io.spinnaker.rosco:rosco-manifests (Maven) | 2026.0.0 to before 2026.0.3 | 2026.0.3 | Patch available | GHSA-p68j-q7hf-3qcp |
| — | io.spinnaker.rosco:rosco-manifests (Maven) | 2026.1.0 to before 2026.1.1 | 2026.1.1 | Patch available | GHSA-p68j-q7hf-3qcp |
- spinnaker Vendorspinnaker Affected 2026.1.0 to before 2026.1.1; 2026.0.0 to before 2026.0.3; 2025.4.0 to before 2025.4.4; before 2025.3.4 Fixed in 2026.1.1, 2026.0.3, 2025.4.4, 2025.3.4 Patch available CNA
- io.spinnaker.rosco:rosco-manifests (Maven) Vendor— Affected before 2025.3.4 Fixed in 2025.3.4 Patch available GHSA-p68j-q7hf-3qcp
- io.spinnaker.rosco:rosco-manifests (Maven) Vendor— Affected 2025.4.0 to before 2025.4.4 Fixed in 2025.4.4 Patch available GHSA-p68j-q7hf-3qcp
- io.spinnaker.rosco:rosco-manifests (Maven) Vendor— Affected 2026.0.0 to before 2026.0.3 Fixed in 2026.0.3 Patch available GHSA-p68j-q7hf-3qcp
- io.spinnaker.rosco:rosco-manifests (Maven) Vendor— Affected 2026.1.0 to before 2026.1.1 Fixed in 2026.1.1 Patch available GHSA-p68j-q7hf-3qcp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* | 2025.3.0 to before 2025.3.4; 2025.4.0 to before 2025.4.4; 2026.0.0 to before 2026.0.3; 2026.1.0 to before 2026.1.1 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* Versions 2025.3.0 to before 2025.3.4; 2025.4.0 to before 2025.4.4; 2026.0.0 to before 2026.0.3; 2026.1.0 to before 2026.1.1 Vulnerable ·backstage
Remediation
- Fix · CNA spinnaker (spinnaker) Fixed in 2026.1.1, 2026.0.3, 2025.4.4, 2025.3.4
- Fix · GHSA-p68j-q7hf-3qcp io.spinnaker.rosco:rosco-manifests (Maven) Fixed in 2025.3.4 Advisory →
- Fix · GHSA-p68j-q7hf-3qcp io.spinnaker.rosco:rosco-manifests (Maven) Fixed in 2025.4.4 Advisory →
- Fix · GHSA-p68j-q7hf-3qcp io.spinnaker.rosco:rosco-manifests (Maven) Fixed in 2026.0.3 Advisory →
- Fix · GHSA-p68j-q7hf-3qcp io.spinnaker.rosco:rosco-manifests (Maven) Fixed in 2026.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55175
- 2026-10-03 Alias added: GHSA-p68j-q7hf-3qcp
References
Patch 5
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
Advisory 2
Other 6
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0
- https://github.com/spinnaker/spinnaker
More spinnaker vulnerabilities
- TI-2021-16529 Path Traversal in spinnaker CVSS 3.1HIGH 7.1
- TI-2021-19638 Improper Access Control in spinnaker CVSS 3.1CRITICAL 10.0
- TI-2026-25122 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling CVSS 3.1CRITICAL 10.0
- TI-2026-25113 Improper input validation in spinnaker CVSS 3.1CRITICAL 10.0
- TI-2026-32679 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types CVSS 3.1HIGH 8.8
- TI-2020-07437 Server-side request forgery in Netflix Orca Spinnaker CVSS 3.1HIGH 7.5
Sources
- CVE-2026-55175 · CVE Program
- CVE-2026-55175 · NVD
- FIRST EPSS
- GHSA-p68j-q7hf-3qcp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences