Kurz gesagt
- CVE-2026-55175 ist eine Schwachstelle (HOCH (CVSS 7.5)) in io.spinnaker.rosco:rosco-manifests, spinnaker (linuxfoundation).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 64.5% aller Schwachstellen.
- Abhilfe: auf 2025.4.4, 2026.0.3, 2026.1.1, 2025.3.4 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| io.spinnaker.rosco:rosco-manifests Maven | ≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1< 2025.3.4
| 2025.4.42026.0.32026.1.12025.3.4
|
| spinnaker | ≥ 2025.3.0, < 2025.3.4≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1
| 2025.3.42025.4.42026.0.32026.1.1
|
Description
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
NVD description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free