Summary
Spinnaker: Improper yaml processing on kustomize bake operations
Advisory details
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
References
- https://github.com/advisories/GHSA-p68j-q7hf-3qcp
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-55175
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-70035
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-87697
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-83520
Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
- MEDIUMCVE-2026-83557
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
- MEDIUMGHSA-2jx3-ff3v-j7jj
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB