GitHub Advisoryadvisory · Maven

GHSA-p68j-q7hf-3qcp Spinnaker: Improper yaml processing on kustomize bake operations

HIGH Published 2026-08-28 Modified 2026-08-28 Official page ↗
Aliases
CVE-2026-55175
Ecosystem
Maven
Packages
io.spinnaker.rosco:rosco-manifests
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2026-08-28

Affected packages

• Maven io.spinnaker.rosco:rosco-manifests: < 2025.3.4 → fixed in 2025.3.4 • Maven io.spinnaker.rosco:rosco-manifests: >= 2025.4.0, < 2025.4.4 → fixed in 2025.4.4 • Maven io.spinnaker.rosco:rosco-manifests: >= 2026.0.0, < 2026.0.3 → fixed in 2026.0.3 • Maven io.spinnaker.rosco:rosco-manifests: >= 2026.1.0, < 2026.1.1 → fixed in 2026.1.1

Description

Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider. Workarounds Disable kustomize bakes

Related

Alias · CVE (1)

  • CVE-2026-55175 Spinnaker is an open source, multi-cloud continuous delivery platform. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References