Vulnerabilities

TI-2026-39859 CVE-2026-55175 · GHSA-p68j-q7hf-3qcp

Spinnaker: Improper yaml processing on kustomize bake operations

LOW 37

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01057 Published 2026-07-10 Fixed in 2026.1.1, 2026.0.3 +2 CWE-502

TI-2026-32679 CVE-2026-44795 · GHSA-c8q4-9h32-2ww8

Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

MEDIUM 42

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01012 Published 2026-07-10 Fixed in 2025.4.4, 2026.0.3 +1 CWE-470

TI-2026-25122 CVE-2026-32613 · GHSA-69rw-45wj-g4v6

Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling

MEDIUM 44

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00553 Published 2026-04-20 Fixed in 2026.0.1, 2025.4.2 +2 CWE-94

TI-2026-25113 CVE-2026-32604 · GHSA-x3j7-7pgj-h87r

Improper input validation in spinnaker

MEDIUM 44

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00619 Published 2026-04-20 Fixed in 2026.0.1, 2025.4.2 +2 CWE-20

TI-2025-38266 CVE-2025-61916 · GHSA-vrjc-q2fh-6x9h

Spinnaker vulnerable to SSRF due to improper restrictions on http from user input

LOW 34

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 7.9 Local Low privileges No interaction EPSS 0.0017 Published 2026-01-05 Fixed in 2025.1.6, 2025.2.3 CWE-20

TI-2023-20487 CVE-2023-39348 · GHSA-rq5c-hvw6-8pr7

Improper log output when using GitHub Status Notifications in spinnaker

LOW 24

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00381 Published 2023-08-28 Fixed in 1.28.8, 1.29.6 +2 CWE-532

TI-2022-07565 CVE-2022-23506

Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

LOW 34

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00587 Published 2023-01-03 Fixed in 1.27.3, 1.28.4 +1 CWE-532

TI-2021-19638 CVE-2021-43832

Improper Access Control in spinnaker

MEDIUM 54

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02655 Published 2022-01-04 Fixed in 1.26.7, 1.25.8 CWE-306

TI-2021-16529 CVE-2021-39143

Path Traversal in spinnaker

MEDIUM 64

Spinnaker is an open source, multi-cloud continuous delivery platform.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00356 Published 2022-01-04 Fixed in 1.26.7, 1.25.7 +1 CWE-22

TI-2020-07437 CVE-2020-9298 · GHSA-4fcw-pq4r-f4q7

Server-side request forgery in Netflix Orca Spinnaker

LOW 36

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01349 Published 2020-08-28 Fixed in 8.7.0 CWE-918

Vulnerabilities

Filters