https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:48:54.133442+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337799 EUVD-2026-337799 2026-10-06T15:48:54.286072+00:00 EUVD-2026-337799 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44795 fkie_cve-2026-44795 2026-10-06T15:48:54.286120+00:00

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

 https://cve.radiocsirt.org/vuln/ghsa-c8q4-9h32-2ww8 GHSA-c8q4-9h32-2ww8 — Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types 2026-10-06T15:48:54.286174+00:00

Affected: Maven: io.spinnaker.rosco:rosco-core, Maven: io.spinnaker.orca:orca-core

### Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: * CloudFormation deployments * CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

### Patches 2025.3.3, 2026.0.3 and 2025.4.4.

### Workarounds Disable the CloudFormation system and cloudfoundry baking operations.

### Resources Join Spinnaker on Slack for more information!