Vulnerabilities

TI-2026-39859 CVE-2026-55175 · GHSA-p68j-q7hf-3qcp

Spinnaker: Improper yaml processing on kustomize bake operations

LOW 37

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01057 Published 2026-07-10 Fixed in 2026.1.1, 2026.0.3 +2 CWE-502

TI-2026-32679 CVE-2026-44795 · GHSA-c8q4-9h32-2ww8

Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

MEDIUM 42

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01012 Published 2026-07-10 Fixed in 2025.4.4, 2026.0.3 +1 CWE-470

TI-2026-25122 CVE-2026-32613 · GHSA-69rw-45wj-g4v6

Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling

MEDIUM 44

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00553 Published 2026-04-20 Fixed in 2026.0.1, 2025.4.2 +2 CWE-94

TI-2026-25113 CVE-2026-32604 · GHSA-x3j7-7pgj-h87r

Improper input validation in spinnaker

MEDIUM 44

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00619 Published 2026-04-20 Fixed in 2026.0.1, 2025.4.2 +2 CWE-20

TI-2025-38266 CVE-2025-61916 · GHSA-vrjc-q2fh-6x9h

Spinnaker vulnerable to SSRF due to improper restrictions on http from user input

LOW 34

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 7.9 Local Low privileges No interaction EPSS 0.0017 Published 2026-01-05 Fixed in 2025.1.6, 2025.2.3 CWE-20

TI-2023-20487 CVE-2023-39348 · GHSA-rq5c-hvw6-8pr7

Improper log output when using GitHub Status Notifications in spinnaker

LOW 24

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00381 Published 2023-08-28 Fixed in 1.28.8, 1.29.6 +2 CWE-532

TI-2022-07565 CVE-2022-23506

Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

LOW 34

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00587 Published 2023-01-03 Fixed in 1.27.3, 1.28.4 +1 CWE-532

TI-2021-19638 CVE-2021-43832

Improper Access Control in spinnaker

MEDIUM 54

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02655 Published 2022-01-04 Fixed in 1.26.7, 1.25.8 CWE-306

TI-2021-16529 CVE-2021-39143

Path Traversal in spinnaker

MEDIUM 64

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00356 Published 2022-01-04 Fixed in 1.26.7, 1.25.7 +1 CWE-22

TI-2020-07440 CVE-2020-9301 · GHSA-mgvh-5mj6-fprr

Deserialization of untrusted data in Netflix Spinnaker

MEDIUM 41

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01523 Published 2020-12-11 No fix listed CWE-502

Vulnerabilities

Filters