CVE-2026-55175 json
Spinnaker: Improper yaml processing on kustomize bake operations
published 2026-07-10 3 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-43087 , GHSA-p68j-q7hf-3qcp
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
Patch / fix
- maven io.spinnaker.rosco:rosco-manifests 2025.3.4, 2025.4.4, 2026.0.3, 2026.1.1
- io.spinnaker.rosco rosco-manifests 2025.3.4, 2025.4.4, 2026.0.3, 2026.1.1
- linuxfoundation spinnaker 2025.3.4, 2025.4.4, 2026.0.3, 2026.1.1
- github.com/spinnaker/spinnaker@2d75818 commit
- github.com/spinnaker/spinnaker@bbc30c9 commit
- github.com/spinnaker/spinnaker@de5a7a0 commit
- github.com/spinnaker/spinnaker@df32d56 commit
- github.com/spinnaker/spinnaker@f5cec21 commit
- github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4 release
- github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4 release
- github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3 release
- github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1 release
- github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 3 mo ago
Exploit prediction
1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.spinnaker.rosco:rosco-manifests | <2025.3.4 >=2025.4.0, <2025.4.4 >=2026.0.0, <2026.0.3 >=2026.1.0, <2026.1.1 |
2025.3.4 2025.4.4 2026.0.3 2026.1.1 |
Affected products
- spinnaker spinnaker
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
web, patch
-
github.com
/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
web, patch
-
github.com
/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
web, patch
-
github.com
/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
web, patch
-
github.com
/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
web, patch
-
github.com
/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp
web, third-party-advisory
-
github.com
/spinnaker/spinnaker/releases/tag/rosco-2025.3.4
web, release-notes
-
github.com
/spinnaker/spinnaker/releases/tag/rosco-2025.4.4
web, release-notes
-
github.com
/spinnaker/spinnaker/releases/tag/rosco-2026.0.3
web, release-notes
-
github.com
/spinnaker/spinnaker/releases/tag/rosco-2026.1.1
web, release-notes
-
github.com
/spinnaker/spinnaker/releases/tag/rosco-2026.2.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-55175
advisory
-
github.com
/spinnaker/spinnaker
package
Sources
- CVE List CVE-2026-55175
- GitHub Advisory GHSA-p68j-q7hf-3qcp
- NVD CVE-2026-55175
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.