HIGH🇵🇱 Wersja polska

CVE-2026-55175

CVSS 7.5v3.1pub. 2026-07-10upd. 2026-07-21

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Linuxfoundation Spinnaker

    APP
    Linuxfoundation
    2025.3.0 – 2025.3.4 (excl.)2025.4.0 – 2025.4.4 (excl.)2026.0.0 – 2026.0.3 (excl.)2026.1.0 – 2026.1.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2026-32613CRITICAL9.9PL ✓same product

Spinnaker Echo: nieograniczony dostęp SPeL umożliwia RCE

CVE-2026-32604CRITICAL9.9PL ✓same product

RCE w Spinnaker — wykonanie dowolnych poleceń na podach clouddriver

CVE-2021-43832CRITICAL10.0PL ✓same product

Spinnaker: brak uwierzytelnienia przy tworzeniu i uruchamianiu pipeline'ów

CVE-2026-44795HIGH8.8PL ✓same product

Niebezpieczne przetwarzanie YAML w Spinnaker prowadzące do RCE

CVE-2025-61916HIGH7.9same product

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, a...