Remote Code Execution (RCE)

Spinnaker is vulnerable to remote code execution RCE. The vulnerability is due to unsafe processing of YAML tags during Kustomize bake operations, which allows an attacker to execute arbitrary code remotely on Rosco pods when a Kustomize bake operation is performed...

EUVD-2026-43087

Spinnaker: Improper yaml processing on kustomize bake operations...

GHSA-P68J-Q7HF-3QCP Spinnaker: Improper yaml processing on kustomize bake operations

Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider. Workarounds Disable...

io.spinnaker.rosco:rosco-web (1.20.0) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.20.0)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.20.0 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.24.0) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.24.0)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.24.0 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.8.0-rc.10) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.8.0-rc.10)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.8.0-rc.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.8.0-rc.10 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.8.0-rc.12) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.8.0-rc.12)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.8.0-rc.12 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.8.0-rc.12 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.8.6) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.8.6)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.8.6 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.12.0) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.12.0)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.12.0 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.12.2) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.12.2)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.12.2 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.13.3) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.13.3)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.13.3 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.15.0) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.15.0)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.15.0 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.17.0) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.17.0)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.17.0 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.18.2) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.18.2)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.18.2 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.22.1) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.22.1)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.22.1 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (1.22.2) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (1.22.2)

io.spinnaker.rosco:rosco-manifests MAVEN version 1.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web 1.22.2 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (main-273) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (main-273)

io.spinnaker.rosco:rosco-manifests MAVEN version main-273 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web main-273 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (main-274) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (main-274)

io.spinnaker.rosco:rosco-manifests MAVEN version main-274 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web main-274 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (main-278) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (main-278)

io.spinnaker.rosco:rosco-manifests MAVEN version main-278 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web main-278 Source cves: CVE-2026-55175 Source advisory:...

io.spinnaker.rosco:rosco-web (main-279) potentially affected by CVE-2026-55175 via io.spinnaker.rosco:rosco-manifests (main-279)

io.spinnaker.rosco:rosco-manifests MAVEN version main-279 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.rosco:rosco-manifests and may be impacted: - io.spinnaker.rosco:rosco-web main-279 Source cves: CVE-2026-55175 Source advisory:...