Spinnaker vulnerabilities
3 known CVE vulnerabilities in Spinnaker, translated and rated.
- CVE-2026-55175High
Spinnaker prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 contains a vulnerability in Kustomize bake operations that allows unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes.
- CVE-2026-44795High
A vulnerability in Spinnaker allows remote code execution through unsafe YAML processing when using CloudFormation or CloudFoundry. The use of a non-safe constructor enables arbitrary Java class loading, leading to remote code execution.
- CVE-2023-39348Medium
Spinnaker, an open source multi-cloud continuous delivery platform, has a logging issue where GitHub status is always logged in full. This may lead to the exposure of GitHub tokens in the logging system.