GHSA-p68j-q7hf-3qcp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p68j-q7hf-3qcp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-p68j-q7hf-3qcp
- Aliases
- Published
- 2026-08-28T18:35:06Z
- Modified
- 2026-09-15T06:34:51Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Spinnaker: Improper yaml processing on kustomize bake operations
- Details
-
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
- Database specific
{ "cwe_ids": [ "CWE-502" ], "github_reviewed": true, "github_reviewed_at": "2026-08-28T18:35:06Z", "nvd_published_at": "2026-07-10T23:16:48Z", "severity": "HIGH" }- References
-
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-55175
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
- https://github.com/spinnaker/spinnaker
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0
Affected packages
Maven
io.spinnaker.rosco:rosco-manifests
Package
- Name
- io.spinnaker.rosco:rosco-manifests
- View open source insights on deps.dev
- Purl
- pkg:maven/io.spinnaker.rosco/rosco-manifests
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2025.3.4
Affected versions
Other
main-5
main-6
main-7
main-8
main-9
main-10
main-11
main-12
main-13
main-14
main-15
main-16
main-17
main-18
main-19
main-20
main-21
main-22
main-23
main-24
main-30
main-31
main-32
main-33
main-34
main-35
main-36
main-37
main-38
main-39
main-40
main-41
main-42
main-43
main-44
main-45
main-46
main-47
main-48
main-49
main-50
main-51
main-52
main-53
main-54
main-55
main-56
main-57
main-58
main-59
main-60
main-61
main-62
main-63
main-64
main-65
main-66
main-67
main-68
main-69
main-70
main-71
main-72
main-73
main-74
main-75
main-76
main-77
main-78
main-79
main-80
main-81
main-84
main-85
main-86
main-87
main-88
main-89
main-90
main-91
main-92
main-93
main-94
main-95
main-96
main-97
main-98
main-99
main-100
main-101
main-102
main-103
main-104
main-105
main-107
main-108
main-109
main-110
main-111
main-112
main-113
main-114
main-115
main-116
main-117
main-118
main-119
main-120
main-121
main-122
main-123
main-124
main-125
main-126
main-127
main-128
main-129
main-130
main-131
main-132
main-133
main-134
main-135
main-136
main-137
main-138
main-139
main-140
main-141
main-142
main-143
main-144
main-145
main-146
main-147
main-148
main-149
main-150
main-151
main-152
main-153
main-154
main-155
main-156
main-157
main-158
main-159
main-160
main-161
main-162
main-163
main-164
main-165
main-166
main-167
main-168
main-169
main-170
main-171
main-172
main-173
main-174
main-175
main-176
main-177
main-178
main-179
main-180
main-181
main-182
main-183
main-184
main-185
main-186
main-187
main-188
main-189
main-190
main-191
main-192
main-193
main-194
main-195
main-196
main-197
main-198
main-199
main-200
main-201
main-202
main-203
main-204
main-205
main-206
main-207
main-208
main-209
main-210
main-211
main-212
main-213
main-214
main-215
main-216
main-217
main-218
main-219
main-220
main-221
main-222
main-223
main-224
main-225
main-226
main-227
main-228
main-229
main-230
main-231
main-232
main-233
main-234
main-235
main-236
main-237
main-239
main-241
main-272
main-273
main-274
main-275
main-276
main-277
main-278
main-279
main-280
main-281
main-282
main-283
main-284
main-285
main-286
main-287
main-288
main-289
main-290
main-291
main-292
main-293
main-294
main-295
main-296
main-297
main-298
main-299
main-300
main-301
main-302
main-303
main-304
main-305
main-306
main-307
main-308
main-309
main-310
main-311
main-312
main-313
main-314
main-315
main-316
main-317
main-318
main-319
main-320
main-321
main-322
main-323
main-324
main-325
main-326
main-327
main-328
main-329
main-330
main-331
main-332
main-333
main-334
main-335
main-336
main-337
main-338
main-339
main-340
main-341
main-342
main-343
1.*
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
1.7.8
1.8.0-rc.1
1.8.0-rc.2
1.8.0-rc.3
1.8.0-rc.4
1.8.0-rc.5
1.8.0-rc.6
1.8.0-rc.7
1.8.0-rc.8
1.8.0-rc.9
1.8.0-rc.10
1.8.0-rc.11
1.8.0-rc.12
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.10.0
1.11.0
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.14.0
1.15.0
1.16.0
1.17.0
1.17.1
1.17.2
1.18.0
1.18.1
1.18.2
1.19.0
1.19.1
1.20.0
1.20.1
1.20.2
1.20.3
1.21.0
1.21.1
1.22.0
1.22.1
1.22.2
1.23.0
1.23.1
1.24.0
1.25.0
1.26.0
2025.*
2025.0-0
2025.0.0
2025.0-1
2025.0-2
2025.0-3
2025.0-4
2025.0-5
2025.0-6
2025.0-7
2025.0-8
2025.0-9
2025.0-10
2025.0-11
2025.0-12
2025.0-13
2025.0-14
2025.0-15
2025.0-16
2025.0-17
2025.0-18
2025.0-19
2025.0-20
2025.0-21
2025.0-22
2025.0-23
2025.0-24
2025.0-25
2025.0.1
2025.0.2
2025.0.3
2025.0.4
2025.0.5
2025.0.6
2025.0.7
2025.0.8
2025.1-0
2025.1.0
2025.1-1
2025.1-2
2025.1-3
2025.1-4
2025.1-5
2025.1-6
2025.1-7
2025.1-8
2025.1-9
2025.1-10
2025.1-11
2025.1-12
2025.1-13
2025.1-14
2025.1-15
2025.1-16
2025.1-17
2025.1-18
2025.1-19
2025.1-20
2025.1-21
2025.1-22
2025.1.1
2025.1.2
2025.1.3
2025.1.4
2025.1.5
2025.1.6
2025.2-0
2025.2.0
2025.2-1
2025.2-2
2025.2-3
2025.2-4
2025.2-5
2025.2-6
2025.2-7
2025.2-8
2025.2-9
2025.2-10
2025.2-11
2025.2-12
2025.2-13
2025.2-14
2025.2-15
2025.2-16
2025.2.1
2025.2.2
2025.2.3
2025.2.4
2025.3-0
2025.3.0
2025.3-1
2025.3-2
2025.3-3
2025.3-4
2025.3-5
2025.3-6
2025.3-7
2025.3-8
2025.3-9
2025.3-11
2025.3-12
2025.3.1
2025.3.2
2025.3.3
io.spinnaker.rosco:rosco-manifests
Package
- Name
- io.spinnaker.rosco:rosco-manifests
- View open source insights on deps.dev
- Purl
- pkg:maven/io.spinnaker.rosco/rosco-manifests
io.spinnaker.rosco:rosco-manifests
Package
- Name
- io.spinnaker.rosco:rosco-manifests
- View open source insights on deps.dev
- Purl
- pkg:maven/io.spinnaker.rosco/rosco-manifests
io.spinnaker.rosco:rosco-manifests
Package
- Name
- io.spinnaker.rosco:rosco-manifests
- View open source insights on deps.dev
- Purl
- pkg:maven/io.spinnaker.rosco/rosco-manifests