PT-2026-57343 · Spinnaker · Spinnaker

CVE-2026-55175

·

Published

2026-07-10

·

Updated

2026-08-28

CVSS v3.1

7.5

High

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.1 Spinnaker versions prior to 2026.0.3 Spinnaker versions prior to 2025.4.4 Spinnaker versions prior to 2025.3.4
Description Unsafe YAML tag processing during Kustomize bake operations in rosco manifests can lead to remote code execution on rosco pods.
Recommendations Update to version 2026.1.1 Update to version 2026.0.3 Update to version 2025.4.4 Update to version 2025.3.4

Exploit

Fix

RCE

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-55175
GHSA-P68J-Q7HF-3QCP

Affected Products

Spinnaker