CVE-2026-55175

HIGH 7.5

Spinnaker: Improper yaml processing on kustomize bake operations

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.

CWE	CWE-502
Vendor	spinnaker
Product	spinnaker
Published	Jul 10, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for spinnaker spinnaker

Be the first to know when new high vulnerabilities affecting spinnaker spinnaker are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

spinnaker / spinnaker

>= 2026.1.0, < 2026.1.1 >= 2026.0.0, < 2026.0.3 >= 2025.4.0, < 2025.4.4 < 2025.3.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗