Most recent entries from all

EUVD-2026-337799

fkie_cve-2026-44795

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

GHSA-c8q4-9h32-2ww8 — Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

Affected: Maven: io.spinnaker.rosco:rosco-core, Maven: io.spinnaker.orca:orca-core

### Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: * CloudFormation deployments * CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

### Patches 2025.3.3, 2026.0.3 and 2025.4.4.

### Workarounds Disable the CloudFormation system and cloudfoundry baking operations.

### Resources Join Spinnaker on Slack for more information!