Description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.
Published: 2026-07-10
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This vulnerability, a deserialization flaw (CWE‑470, CWE‑502), undermines confidentiality, integrity, and availability of the affected instance.

Affected Systems

Any installation of Spinnaker prior to versions 2026.1.0, 2026.0.3, 2025.4.4, or 2025.3.3 is affected. Upgrading to any of those versions or later resolves the issue.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. The EPSS score is 1%, showing a measurable but low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a malicious YAML file supplied in CloudFormation or CloudFoundry deployments that the system processes without proper restrictions, allowing arbitrary class loading and remote code execution.

Generated by OpenCVE AI on July 29, 2026 at 09:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Spinnaker installation to version 2026.1.0, 2026.0.3, 2025.4.4, or 2025.3.3 or later where the unsafe YAML constructor has been removed.
  • Ensure that your YAML processing configuration does not enable unsafe constructors or automatic class loading in any custom plugins or extensions.
  • If an upgrade is not immediately possible, restrict the set of YAML files that the platform can import to a trusted source or validate them against a schema that prohibits arbitrary Java class references.

Generated by OpenCVE AI on July 29, 2026 at 09:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c8q4-9h32-2ww8 Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types
History

Tue, 14 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 11 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Spinnaker
Spinnaker spinnaker
Vendors & Products Spinnaker
Spinnaker spinnaker

Fri, 10 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.
Title Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
Weaknesses CWE-470
CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Spinnaker Spinnaker
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T03:59:56.097Z

Reserved: 2026-05-07T19:20:44.693Z

Link: CVE-2026-44795

cve-icon Vulnrichment

Updated: 2026-07-14T14:17:20.387Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T09:45:04Z

Weaknesses
  • CWE-470

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

  • CWE-502

    Deserialization of Untrusted Data