In breve
- CVE-2026-55175 è una vulnerabilità ALTO (CVSS 7.5) che riguarda io.spinnaker.rosco:rosco-manifests, spinnaker (linuxfoundation).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.5% delle vulnerabilità.
- Correzione: aggiornare a 2025.4.4, 2026.0.3, 2026.1.1, 2025.3.4 o successiva.
| Package | Affected versions | Patched versions |
|---|
| io.spinnaker.rosco:rosco-manifests Maven | ≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1< 2025.3.4
| 2025.4.42026.0.32026.1.12025.3.4
|
| spinnaker | ≥ 2025.3.0, < 2025.3.4≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1
| 2025.3.42025.4.42026.0.32026.1.1
|
Description
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
NVD description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free