Em resumo
- CVE-2026-55175 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta io.spinnaker.rosco:rosco-manifests, spinnaker (linuxfoundation).
- Chance de exploração nos próximos 30 dias (EPSS): 1.1%, maior que 64.5% das vulnerabilidades.
- Correção: atualize para 2025.4.4, 2026.0.3, 2026.1.1, 2025.3.4 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| io.spinnaker.rosco:rosco-manifests Maven | ≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1< 2025.3.4
| 2025.4.42026.0.32026.1.12025.3.4
|
| spinnaker | ≥ 2025.3.0, < 2025.3.4≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3≥ 2026.1.0, < 2026.1.1
| 2025.3.42025.4.42026.0.32026.1.1
|
Description
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
NVD description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free