HIGH7.5
GHSA-p68j-q7hf-3qcp
Spinnaker: Improper yaml processing on kustomize bake operations
Quick fix
GHSA-p68j-q7hf-3qcp — io.spinnaker.rosco:rosco-manifests: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2025.3.4</version> for io.spinnaker.rosco:rosco-manifestsDetails
### Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
### Workarounds Disable kustomize bakes
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/io.spinnaker.rosco:rosco-manifests
Introduced in:
0Fixed in: 2025.3.4Fix
# pom.xml: bump <version>2025.3.4</version> for io.spinnaker.rosco:rosco-manifestsMaven/io.spinnaker.rosco:rosco-manifests
Introduced in:
2025.4.0Fixed in: 2025.4.4Fix
# pom.xml: bump <version>2025.4.4</version> for io.spinnaker.rosco:rosco-manifestsMaven/io.spinnaker.rosco:rosco-manifests
Introduced in:
2026.0.0Fixed in: 2026.0.3Fix
# pom.xml: bump <version>2026.0.3</version> for io.spinnaker.rosco:rosco-manifestsMaven/io.spinnaker.rosco:rosco-manifests
Introduced in:
2026.1.0Fixed in: 2026.1.1Fix
# pom.xml: bump <version>2026.1.1</version> for io.spinnaker.rosco:rosco-manifestsReferences
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-55175[ADVISORY]
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe[WEB]
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7[WEB]
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009[WEB]
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd[WEB]
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f[WEB]
- https://github.com/spinnaker/spinnaker[PACKAGE]
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4[WEB]
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4[WEB]
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3[WEB]
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1[WEB]
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0[WEB]