Vulnerability details
CVE-2026-55175
spinnaker spinnaker
Spinnaker: Improper yaml processing on kustomize bake operations
CVSS 3.1
7.5High
Official description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| spinnaker | spinnaker | < 2025.3.4 | CVEProject cvelistV5 (CNA) |
| spinnaker | spinnaker | >= 2025.4.0, < 2025.4.4 | CVEProject cvelistV5 (CNA) |
| spinnaker | spinnaker | >= 2026.0.0, < 2026.0.3 | CVEProject cvelistV5 (CNA) |
| spinnaker | spinnaker | >= 2026.1.0, < 2026.1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
11- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp x_refsource_CONFIRM
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe x_refsource_MISC
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd x_refsource_MISC
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1 x_refsource_MISC
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-11
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
1.05%
Probability of exploitation in 30 days
64.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-502Deserialization of Untrusted Data