Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

CAO 8.8CVE-2026-44795 · GHSA-c8q4-9h32-2ww8 · Công bố 10/07/2026 · cập nhật 21/07/2026

Tóm tắt nhanh

CVE-2026-44795 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng io.spinnaker.orca:orca-core, io.spinnaker.rosco:rosco-core, spinnaker (linuxfoundation).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 63.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2025.4.4, 2026.0.3, 2025.3.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
io.spinnaker.orca:orca-core Maven	`≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3< 2025.3.3`	`2025.4.42026.0.32025.3.3`
io.spinnaker.rosco:rosco-core Maven	`≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3< 2025.3.3`	`2025.4.42026.0.32025.3.3`
spinnaker linuxfoundation	`≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3< 2025.3.3`	`2025.4.42026.0.32025.3.3`

Mô tả

Impact

There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:

CloudFormation deployments
CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

Patches

2025.3.3, 2026.0.3 and 2025.4.4.

Workarounds

Disable the CloudFormation system and cloudfoundry baking operations.

Resources

Join Spinnaker on Slack for more information!

Mô tả của NVD

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.