| Package | Affected versions | Patched versions |
|---|---|---|
| io.spinnaker.orca:orca-core | ≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3< 2025.3.3 | 2025.4.42026.0.32025.3.3 |
| io.spinnaker.rosco:rosco-core | ≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3< 2025.3.3 | 2025.4.42026.0.32025.3.3 |
| spinnaker | ≥ 2025.4.0, < 2025.4.4≥ 2026.0.0, < 2026.0.3< 2025.3.3 | 2025.4.42026.0.32025.3.3 |
There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:
The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.
2025.3.3, 2026.0.3 and 2025.4.4.
Disable the CloudFormation system and cloudfoundry baking operations.
Join Spinnaker on Slack for more information!
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free