Résumé
Spinnaker: Improper yaml processing on kustomize bake operations
Détails de l’avis
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
Références
- https://github.com/advisories/GHSA-p68j-q7hf-3qcp
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-55175
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
Vulnérabilités liées
Tout Supply chain →- HIGHGHSA-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
- CRITICALCVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
- HIGHGHSA-wg9g-w2j2-8pgr
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
- HIGHGHSA-qxq5-qhx6-94qw
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
- CRITICALCVE-2026-62263
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
- CRITICALCVE-2026-59940
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization