GitHub Advisoryadvisory · Maven

GHSA-c8q4-9h32-2ww8 Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

HIGH Published 2026-06-22 Modified 2026-08-05 Official page ↗
Aliases
CVE-2026-44795
Ecosystem
Maven
Packages
io.spinnaker.rosco:rosco-core, io.spinnaker.orca:orca-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Weaknesses
CWE-470, CWE-502
Reviewed
2026-06-22

Affected packages

• Maven io.spinnaker.rosco:rosco-core: < 2025.3.3 → fixed in 2025.3.3 • Maven io.spinnaker.orca:orca-core: < 2025.3.3 → fixed in 2025.3.3 • Maven io.spinnaker.rosco:rosco-core: >= 2025.4.0, < 2025.4.4 → fixed in 2025.4.4 • Maven io.spinnaker.rosco:rosco-core: >= 2026.0.0, < 2026.0.3 → fixed in 2026.0.3 • Maven io.spinnaker.orca:orca-core: >= 2025.4.0, < 2025.4.4 → fixed in 2025.4.4 • Maven io.spinnaker.orca:orca-core: >= 2026.0.0, < 2026.0.3 → fixed in 2026.0.3

Description

Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: • CloudFormation deployments • CloudFoundry Baking The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE. Patches 2025.3.3, 2026.0.3 and 2025.4.4. Workarounds Disable the CloudFormation system and cloudfoundry baking operations. Resources Join Spinnaker on Slack for more information!

Related

Alias · CVE (1)

  • CVE-2026-44795 Spinnaker is an open source, multi-cloud continuous delivery platform. vulnerability

Weakness · CWE (2)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References