Spinnaker: Improper yaml processing on kustomize bake operations

高 7.5CVE-2026-55175 · GHSA-p68j-q7hf-3qcp · 10/07/2026 公開 · 21/07/2026 更新

要点

CVE-2026-55175 は io.spinnaker.rosco:rosco-manifests, spinnaker (linuxfoundation) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 64.5% より高い）。
対処：2025.4.4, 2026.0.3, 2026.1.1, 2025.3.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
io.spinnaker.rosco:rosco-manifests Maven	`≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1< 2025.3.4`	`2025.4.42026.0.32026.1.12025.3.4`
spinnaker linuxfoundation	`≥ 2025.3.0, < 2025.3.4≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1`	`2025.3.42025.4.42026.0.32026.1.1`

概要

Impact

Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.

Workarounds

Disable kustomize bakes

NVD の説明

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.