Vulnerability Description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Spinnaker | >= 2025.3.0, < 2025.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcPatch
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd7Patch
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67Patch
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba007Patch
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1Patch
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4Release Notes
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4Release Notes
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3Release Notes
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1Release Notes
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0Release Notes
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcpThird Party Advisory
FAQ
What is CVE-2026-55175?
CVE-2026-55175 is a vulnerability with a CVSS score of 7.5 (HIGH). Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow u...
How severe is CVE-2026-55175?
CVE-2026-55175 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55175?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Spinnaker.