HIGH🇵🇱 Wersja polska

CVE-2026-44795

CVSS 8.8v3.1pub. 2026-07-10upd. 2026-07-21

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Linuxfoundation Spinnaker

    APP
    Linuxfoundation
    < 2025.3.32025.4.0 – 2025.4.4 (excl.)2026.0.0 – 2026.0.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2026-32613CRITICAL9.9PL ✓same product

Spinnaker Echo: nieograniczony dostęp SPeL umożliwia RCE

CVE-2026-32604CRITICAL9.9PL ✓same product

RCE w Spinnaker — wykonanie dowolnych poleceń na podach clouddriver

CVE-2021-43832CRITICAL10.0PL ✓same product

Spinnaker: brak uwierzytelnienia przy tworzeniu i uruchamianiu pipeline'ów

CVE-2026-55175HIGH7.5PL ✓same product

RCE w Spinnaker poprzez niebezpieczne przetwarzanie tagów YAML w Kustomize

CVE-2025-61916HIGH7.9same product

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, a...