CLEANSTART-2026-FP54801 Security fixes in kustomize 5.7.1-r1

Package kustomize version 5.7.1-r1 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2025-61732, CVE-2022-3219...

CLEANSTART-2026-WE34008 Security fixes in kustomize 5.7.1-r3

Package kustomize version 5.7.1-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

CVE-2026-55175

Spinnaker CVE-2026-55175 affects Rosco/Kustomize bake operations where unsafe YAML tag processing in rosco manifests can lead to remote code execution on rosco pods. Affected versions are prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 across release lines; fixes are available in 2026.1.1, 20...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

PT-2026-57343

Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.1 Spinnaker versions prior to 2026.0.3 Spinnaker versions prior to 2025.4.4 Spinnaker versions prior to 2025.3.4 Description Unsafe YAML tag processing during Kustomize bake operations in rosco manifests can...

CVE-2026-55175: Deserialization of Untrusted Data

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: nemo, harbor, ko-fips, prometheus-elasticsearch-exporter, terragrunt, pulumi-language-java, buildkitd-fips, prometheus-podman-exporter, buildah-fips, tkn-fips, argocd-image-updater-fips, etcd-fips, flux-notification-controller, gomplate-fips, gptscript, cilium-cli,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: openbao, flux-image-automation-controller, falcoctl, opentofu, opentelemetry-collector, rancher, external-dns, terragrunt, pulumi-kubernetes-operator, mattermost, kine, zot, buildkitd, nerdctl, flux-kustomize-controller, tkn, prometheus-operator, prometheus,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: osv-scanner, victoriametrics, github-mcp-server, nfs-subdir-external-provisioner, mountpoint-s3-csi-driver, rabbitmq-messaging-topology-operator, actions-runner-controller, nova, flux, flux-image-automation-controller, go, karpenter, supercronic,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: terragrunt, velero-plugin-for-gcp-fips, beats, cloudprober, melange, cloudflared-fips, sqlexporter-fips, grpc-health-probe, dex, bank-vaults-fips, grype, flux-kustomize-controller, zitadel, kiali, oauth2-proxy, cert-manager, listmonk, chainloop-artifact-cas-fips, tkn...

CLEANSTART-2026-YB46455 Security fixes for CVE-2022-3219, CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142 applied in versions: 5.7.1-r1, 5.7.1-r3

Multiple security vulnerabilities affect the kustomize package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VP44686 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61732, CVE-2025-68121 applied in versions: 5.7.1-r0, 5.7.1-r1

Multiple security vulnerabilities affect the kustomize-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-42342

Multiple security vulnerabilities affect the kustomize-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: grafana-mimir, helm-diff, harbor, crossplane-provider-terraform-fips, nemo, crossplane-provider-aws-s3, pulumi-language-java, livekit-cli, tigera-operator, contour-fips, crossplane-provider-aws-servicediscovery-fips, cilium-cli, crossplane-provider-aws-efs,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: grafana-mimir, helm-diff, harbor, crossplane-provider-terraform-fips, nemo, crossplane-provider-aws-s3, pulumi-language-java, livekit-cli, tigera-operator, contour-fips, crossplane-provider-aws-servicediscovery-fips, cilium-cli, crossplane-provider-aws-efs,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: openbao, flux-image-automation-controller, src-fingerprint, opentofu, crossplane-provider-aws-dynamodb, terragrunt, rclone, pulumi-kubernetes-operator, crossplane-provider-aws-sns, crossplane-provider-aws-cloudwatchlogs, trufflehog, zot, buildkitd,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: openbao, flux-image-automation-controller, src-fingerprint, opentofu, crossplane-provider-aws-dynamodb, terragrunt, rclone, pulumi-kubernetes-operator, crossplane-provider-aws-sns, crossplane-provider-aws-cloudwatchlogs, trufflehog, zot, buildkitd,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: helm-diff, terragrunt, crossplane-provider-aws-s3, pulumi-language-java, buildkitd-fips, livekit-cli, argocd-image-updater-fips, flux-notification-controller, gomplate-fips, gptscript, actions-runner-controller, cilium-cli, crossplane-provider-aws-efs,...