What is the CVSS score of EUVD-2026-43087?

EUVD-2026-43087 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Spinnaker are affected by EUVD-2026-43087?

Spinnaker's Rosco bakery service contains a remote code execution vulnerability that allows authenticated users to execute arbitrary code on deployment infrastructure pods, potentially compromising…. A patch is available.

How to fix or mitigate EUVD-2026-43087?

Within 24 hours: Audit your Spinnaker deployment to identify the current release version and line (2026.1.x, 2026.0.x, 2025.4.x, 2025.3.x, or earlier). Within 7 days: Test upgrade to the minimum patched version for your release line: 2026.1.1 or later, 2026.0.3 or later, 2025.4.4 or later, or 2025.3.4 or later. Within 30 days: Deploy the patched release to all production Spinnaker environments.

Spinnaker EUVD-2026-43087

| CVE-2026-55175 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-10 GitHub_M

GHSA-p68j-q7hf-3qcp

RCE Deserialization Spinnaker

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Reachable over the network via the pipeline API but requires authenticated bake-trigger privileges (PR:L) and a crafted YAML-tag payload (AC:H); RCE on the pod yields full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 22:50 vuln.today

DescriptionCVE.org

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.

AnalysisAI

Remote code execution in Spinnaker's Rosco bakery service allows an authenticated user to run arbitrary code on Rosco pods by supplying a manifest that abuses unsafe YAML tag processing during Kustomize bake operations. The flaw (CWE-502 unsafe deserialization) affects release lines prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4, and grants full compromise of the affected pod (C:H/I:H/A:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-published GitHub Security Advisory (GHSA-p68j-q7hf-3qcp) and multiple fix commits confirm the issue is real and patched.

Technical ContextAI

Spinnaker is an open-source, multi-cloud continuous delivery platform originally from Netflix/Google; Rosco is its 'bakery' microservice that produces machine/manifest images and, in Kubernetes workflows, renders Kustomize overlays into deployable manifests. The vulnerability lies in how Rosco parses YAML during a Kustomize bake: it processes YAML with an unsafe loader that honors custom/explicit YAML tags (e.g. language-specific object-construction tags) instead of a safe, tag-restricted parser. This maps to CWE-502 (Deserialization of Untrusted Data) - when attacker-controlled manifest content is deserialized with tag processing enabled, crafted tags can instantiate arbitrary objects or invoke constructors, yielding code execution inside the Rosco pod. The single CPE cpe:2.3:a:spinnaker:spinnaker:*:*:* identifies the Spinnaker application generally, but the fix scope (rosco-* release tags) and the description localize the defect specifically to the Rosco component.

RemediationAI

Vendor-released patch: upgrade to Spinnaker/Rosco 2026.1.1, 2026.0.3, 2025.4.4, or 2025.3.4 depending on your release line (or 2026.2.0+), per advisory GHSA-p68j-q7hf-3qcp; the fixes are delivered in commits 2d75818, bbc30c9, de5a7a0, df32d56, and f5cec21 which replace unsafe YAML tag processing with a safe loader during Kustomize bakes. If you cannot patch immediately, reduce exposure by restricting who can create or trigger Kustomize bake pipelines (limit Fiat/authz permissions to trusted operators), and avoid running bakes on untrusted or externally-contributed manifest content - the trade-off is reduced self-service pipeline authoring. As a defense-in-depth measure, tighten the Rosco pod's Kubernetes security context and service-account RBAC so that even a successful bake-triggered RCE has minimal cluster privileges and no unnecessary secret access; note this limits blast radius but does not close the vulnerability. Verify the running Rosco image tag after upgrade, since the patch is component-specific to Rosco rather than the whole Spinnaker bundle.