CVE-2026-55175CWE-502

Spinnaker: Improper yaml processing on kustomize bake operations

High · published July 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01057 · 64.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-10T21:52Z
EPSS history
Timeline
  • 10 JUL 21:52Z
    Spinnaker: Improper yaml processing on kustomize bake operations
    cvelistv5