{"id":"CVE-2026-55175","summary":"Spinnaker: Improper yaml processing on kustomize bake operations","details":"Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.","aliases":["GHSA-p68j-q7hf-3qcp"],"modified":"2026-08-12T16:09:46.021500Z","published":"2026-07-10T21:52:08.166Z","database_specific":{"cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55175.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55175.json"},{"type":"ADVISORY","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55175"},{"type":"FIX","url":"https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe"},{"type":"FIX","url":"https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7"},{"type":"FIX","url":"https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009"},{"type":"FIX","url":"https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd"},{"type":"FIX","url":"https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spinnaker/spinnaker","events":[{"introduced":"ed0023ebff55956d438e0a2424c1c1c66e220f41"},{"fixed":"f5cec213f8cf207843ed5a6929395960a1ca094f"},{"introduced":"6465902a6651ea50fa821259c7bbe68475e49251"},{"fixed":"9e97bec69d0f8c2e8471276fa79eab88f0536925"},{"introduced":"6e1a64976a812b9dab7b61d08e96f0b22b9ed24c"},{"fixed":"5aec138dee89abaeecfa782f0bd8b5bdf16d9a55"},{"introduced":"2d39bc811828d4d864e78c31b10abb1d7a31d0ce"},{"fixed":"a3e1f5e22cb7c78892beed4f795846eb6e12f2e6"},{"fixed":"2d75818b85cc4c35144d5e5ed45e7340fcab5dfe"},{"fixed":"bbc30c9b9034a056e95f012fa1b34e9fd703cae7"},{"fixed":"de5a7a05af35aee19eb71d289cd0b77f67509009"},{"fixed":"df32d568e82519d9f3896fc9007baba0077c87fd"},{"fixed":"6964c765b79691125341522123b509f3a4d4610e"}],"database_specific":{"cpe":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2025.3.0"},{"fixed":"2025.3.4"},{"introduced":"2025.4.0"},{"fixed":"2025.4.4"},{"introduced":"2026.0.0"},{"fixed":"2026.0.3"},{"introduced":"2026.1.0"},{"fixed":"2026.1.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["rosco-2026.2.0","orca-2026.2.0","keel-2026.2.0","kayenta-2026.2.0","igor-2026.2.0","halyard-2026.2.0","gate-2026.2.0","front50-2026.2.0","fiat-2026.2.0","echo-2026.2.0","deck-kayenta-2026.2.0","deck-2026.2.0","clouddriver-2026.2.0","bn-spin-release-2026.2.x-1","rosco-2026.2-0","orca-2026.2-0","keel-2026.2-0","kayenta-2026.2-0","igor-2026.2-0","halyard-main-137","halyard-2026.2-0","gate-2026.2-0","front50-2026.2-0","fiat-2026.2-0","echo-2026.2-0","deck-2026.2-0","clouddriver-main-126","clouddriver-2026.2-0","bn-rosco-release-2026.2.x-0","bn-orca-release-2026.2.x-0","bn-keel-release-2026.2.x-0","bn-kayenta-release-2026.2.x-0","bn-igor-release-2026.2.x-0","bn-gate-release-2026.2.x-0","bn-front50-release-2026.2.x-0","bn-fiat-release-2026.2.x-0","bn-echo-release-2026.2.x-0","bn-deck-release-2026.2.x-0","rosco-main-76","orca-main-123","keel-main-75","kayenta-main-126","igor-main-83","halyard-main-136","gate-main-113","front50-main-78","fiat-main-73","echo-main-90","clouddriver-main-125","bn-rosco-main-76","bn-orca-main-123","bn-keel-main-75","bn-kayenta-main-126","bn-igor-main-83","bn-gate-main-113","bn-front50-main-78","bn-fiat-main-73","bn-echo-main-90","orca-main-122","kayenta-main-125","gate-main-112","halyard-main-135","echo-main-89","halyard-main-134","clouddriver-main-123","halyard-main-133","clouddriver-main-122","bn-spinnaker-gradle-project-main-13","deck-main-5","deck-main-4","bn-deck-main-5","gate-main-111","echo-main-88","echo-2025.4-7","echo-2026.0-7","echo-2026.1-2","rosco-2025.4-6","bn-rosco-release-2025.4.x-6","rosco-2026.0-6","bn-rosco-release-2026.0.x-6","rosco-2026.1-1","bn-rosco-release-2026.1.x-1","echo-main-87","rosco-main-75","orca-main-121","keel-main-74","kayenta-main-124","igor-main-82","halyard-main-132","gate-main-110","front50-main-77","fiat-main-72","echo-main-86","clouddriver-main-121","echo-2025.3-4","bn-echo-release-2025.3.x-4","echo-2025.4-6","echo-2026.1-1","echo-2026.0-6","rosco-main-74","orca-main-120","keel-main-73","kayenta-main-123","igor-main-81","halyard-main-131","gate-main-109","front50-main-76","fiat-main-71","echo-main-85","clouddriver-main-120","echo-main-84","deck-2025.3-5","bn-deck-release-2025.3.x-5","deck-2025.4-5","bn-deck-release-2025.4.x-5","rosco-2026.0-5","orca-2026.0-4","keel-2026.0-4","kayenta-2026.0-4","igor-2026.0-4","halyard-2026.0-8","gate-2026.0-10","front50-2026.0-4","fiat-2026.0-4","echo-2026.0-5","clouddriver-2026.0-8","bn-orca-release-2026.0.x-4","bn-keel-release-2026.0.x-4","bn-kayenta-release-2026.0.x-4","bn-igor-release-2026.0.x-4","bn-halyard-release-2026.0.x-8","bn-gate-release-2026.0.x-10","bn-front50-release-2026.0.x-4","bn-fiat-release-2026.0.x-4","bn-clouddriver-release-2026.0.x-8","spinnaker-release-2026.1.0","rosco-2026.1.0","rosco-2026.1-0","orca-2026.1.0","orca-2026.1-0","keel-2026.1.0","keel-2026.1-0","kayenta-2026.1.0","kayenta-2026.1-0","igor-2026.1.0","igor-2026.1-0","halyard-main-127","halyard-2026.1.0","halyard-2026.1-0","gate-2026.1.0","gate-2026.1-0","front50-2026.1.0","front50-2026.1-0","fiat-2026.1.0","fiat-2026.1-0","echo-2026.1.0","echo-2026.1-0","deck-kayenta-2026.1.0","deck-2026.1.0","deck-2026.1-1","deck-2026.1-0","clouddriver-main-117","clouddriver-2026.1.0","clouddriver-2026.1-0","bn-spin-release-2026.1.x-0","bn-orca-release-2026.1.x-0","bn-keel-release-2026.1.x-0","bn-kayenta-release-2026.1.x-0","bn-igor-release-2026.1.x-0","bn-halyard-release-2026.1.x-0","bn-gate-release-2026.1.x-0","bn-front50-release-2026.1.x-0","bn-fiat-release-2026.1.x-0","bn-deck-release-2026.1.x-1","bn-clouddriver-release-2026.1.x-0","rosco-main-73","orca-main-119","kayenta-main-122","gate-main-108","echo-main-83","rosco-main-72","orca-main-118","keel-main-72","kayenta-main-121","igor-main-80","halyard-main-130","gate-main-107","front50-main-75","fiat-main-70","echo-main-82","clouddriver-main-119","halyard-2025.3-9","clouddriver-2025.3-8","bn-halyard-release-2025.3.x-9","bn-clouddriver-release-2025.3.x-8","rosco-2025.4-5","orca-2025.4-6","keel-2025.4-4","kayenta-2025.4-6","igor-2025.4-4","halyard-2025.4-11","gate-2025.4-9","front50-2025.4-4","fiat-2025.4-4","echo-2025.4-5","bn-orca-release-2025.4.x-6","bn-keel-release-2025.4.x-4","bn-kayenta-release-2025.4.x-6","bn-igor-release-2025.4.x-4","bn-halyard-release-2025.4.x-11","bn-gate-release-2025.4.x-9","bn-front50-release-2025.4.x-4","bn-fiat-release-2025.4.x-4","bn-clouddriver-release-2025.4.x-10","orca-main-117","kayenta-main-120","halyard-2025.4-10","clouddriver-2025.4-9","halyard-2026.0-7","clouddriver-2026.0-7","orca-main-116","kayenta-main-119","halyard-main-129","front50-main-74","echo-main-81","rosco-main-71","orca-main-115","keel-main-71","kayenta-main-118","igor-main-79","halyard-main-128","gate-main-106","front50-main-73","fiat-main-69","echo-main-80","clouddriver-main-118","spinnaker-release-2026.0.2","rosco-2026.0.2","orca-2026.0.2","keel-2026.0.2","kayenta-2026.0.2","igor-2026.0.2","halyard-2026.0.2","gate-2026.0.2","gate-2026.0-9","front50-2026.0.2","fiat-2026.0.2","echo-2026.0.2","deck-kayenta-2026.0.2","deck-2026.0.2","clouddriver-2026.0.2","spinnaker-release-2025.4.3","rosco-2025.4.3","orca-2025.4.3","keel-2025.4.3","kayenta-2025.4.3","igor-2025.4.3","halyard-2025.4.3","gate-2025.4.3","gate-2025.4-8","front50-2025.4.3","fiat-2025.4.3","echo-2025.4.3","deck-kayenta-2025.4.3","deck-2025.4.3","clouddriver-2025.4.3","deck-2025.3-4","rosco-2025.3.3","orca-2025.3.3","keel-2025.3.3","kayenta-2025.3.3","igor-2025.3.3","halyard-2025.3.3","gate-2025.3.3","gate-2025.3-3","front50-2025.3.3","fiat-2025.3.3","echo-2025.3.3","deck-kayenta-2025.3.3","deck-2025.3.3","clouddriver-2025.3.3","bn-gate-release-2025.3.x-3","gate-2025.4-7","gate-2025.4-6","rosco-2026.0-4","orca-2026.0-3","keel-2026.0-3","kayenta-2026.0-3","igor-2026.0-3","halyard-2026.0-6","gate-2026.0-8","front50-2026.0-3","fiat-2026.0-3","echo-2026.0-4","clouddriver-2026.0-6","rosco-2025.4-4","orca-2025.4-5","keel-2025.4-3","kayenta-2025.4-5","igor-2025.4-3","halyard-2025.4-9","gate-2025.4-5","front50-2025.4-3","fiat-2025.4-3","echo-2025.4-4","clouddriver-2025.4-8","gate-2026.0-7","gate-2025.4-4","gate-2026.0-6","gate-2026.0-5","halyard-2026.0-5","clouddriver-2026.0-5","halyard-2025.4-8","clouddriver-2025.4-7","halyard-2025.3-8","clouddriver-2025.3-7","spinnaker-release-2026.0.1","rosco-2026.0.1","orca-2026.0.1","keel-2026.0.1","kayenta-2026.0.1","igor-2026.0.1","halyard-2026.0.1","gate-2026.0.1","front50-2026.0.1","fiat-2026.0.1","echo-2026.0.1","deck-kayenta-2026.0.1","deck-2026.0.1","clouddriver-2026.0.1","spinnaker-release-2025.3.2","rosco-2025.3.2","orca-2025.3.2","keel-2025.3.2","kayenta-2025.3.2","igor-2025.3.2","halyard-2025.3.2","halyard-2025.3-7","gate-2025.3.2","front50-2025.3.2","fiat-2025.3.2","echo-2025.3.2","echo-2025.3-3","deck-kayenta-2025.3.2","deck-2025.3.2","clouddriver-2025.3.2","clouddriver-2025.3-6","spinnaker-release-2025.4.2","rosco-2025.4.2","orca-2025.4.2","keel-2025.4.2","kayenta-2025.4.2","igor-2025.4.2","halyard-2025.4.2","gate-2025.4.2","front50-2025.4.2","fiat-2025.4.2","echo-2025.4.2","deck-kayenta-2025.4.2","deck-2025.4.2","clouddriver-2025.4.2","gate-2026.0-4","gate-2025.4-3","halyard-2026.0-4","echo-2026.0-3","clouddriver-2026.0-4","halyard-2025.4-7","echo-2025.4-3","clouddriver-2025.4-6","bn-spin-release-2026.0.x-3","gate-2026.0-3","rosco-2026.0.0","rosco-2026.0-3","orca-2026.0.0","orca-2026.0-2","keel-2026.0.0","keel-2026.0-2","kayenta-2026.0.0","kayenta-2026.0-2","igor-2026.0.0","igor-2026.0-2","halyard-2026.0.0","halyard-2026.0-3","gate-2026.0.0","gate-2026.0-2","front50-2026.0.0","front50-2026.0-2","fiat-2026.0.0","fiat-2026.0-2","echo-2026.0.0","echo-2026.0-2","clouddriver-2026.0.0","clouddriver-2026.0-3","rosco-2025.3-2","orca-2025.3-3","keel-2025.3-2","kayenta-2025.3-3","igor-2025.3-2","halyard-2025.3-6","gate-2025.3-2","front50-2025.3-2","fiat-2025.3-2","echo-2025.3-2","clouddriver-2025.3-5","bn-orca-release-2025.3.x-3","bn-keel-release-2025.3.x-2","bn-kayenta-release-2025.3.x-3","bn-igor-release-2025.3.x-2","bn-front50-release-2025.3.x-2","bn-fiat-release-2025.3.x-2","rosco-2025.4-3","orca-2025.4-4","keel-2025.4-2","kayenta-2025.4-4","igor-2025.4-2","halyard-2025.4-6","gate-2025.4-2","front50-2025.4-2","fiat-2025.4-2","echo-2025.4-2","clouddriver-2025.4-5","halyard-2025.3-5","clouddriver-2025.3-4","halyard-2025.4-5","clouddriver-2025.4-4","spinnaker-release-2025.3.1","deck-kayenta-2025.3.1","deck-2025.3.1","orca-2025.3-2","kayenta-2025.3-2","halyard-2025.3-4","clouddriver-2025.3-3","spinnaker-release-2025.4.1","deck-kayenta-2025.4.1","bn-deck-kayenta-release-2025.4.x-6","bn-deck-kayenta-release-2025.3.x-6","rosco-2025.3.1","orca-2025.3.1","keel-2025.3.1","kayenta-2025.3.1","igor-2025.3.1","halyard-2025.3.1","halyard-2025.3-3","gate-2025.3.1","front50-2025.3.1","fiat-2025.3.1","echo-2025.3.1","clouddriver-2025.3.1","clouddriver-2025.3-2","orca-2025.4-3","kayenta-2025.4-3","halyard-2025.4-4","deck-2025.4.1","clouddriver-2025.4-3","halyard-2025.4-3","clouddriver-2025.4-2","deck-2025.3-3","deck-2025.4-4","halyard-2025.4-2","clouddriver-2025.4.1","rosco-2025.3-1","orca-2025.3-1","keel-2025.3-1","kayenta-2025.3-1","igor-2025.3-1","halyard-2025.3-2","gate-2025.3-1","front50-2025.3-1","fiat-2025.3-1","echo-2025.3-1","halyard-2025.3-1","rosco-2025.4.1","rosco-2025.4-2","orca-2025.4.1","orca-2025.4-2","keel-2025.4.1","keel-2025.4-1","kayenta-2025.4.1","kayenta-2025.4-2","igor-2025.4.1","igor-2025.4-1","halyard-2025.4.1","halyard-2025.4-1","gate-2025.4.1","gate-2025.4-1","front50-2025.4.1","front50-2025.4-1","fiat-2025.4.1","fiat-2025.4-1","echo-2025.4.1","echo-2025.4-1","clouddriver-2025.4-1","spinnaker-release-2025.3.0","rosco-2025.3.0","orca-2025.3.0","keel-2025.3.0","kayenta-2025.3.0","igor-2025.3.0","halyard-2025.3.0","gate-2025.3.0","front50-2025.3.0","fiat-2025.3.0","echo-2025.3.0","deck-kayenta-2025.3.0","deck-2025.3.0","clouddriver-2025.3.0","bn-spin-release-2025.3.x-3","orca-2025.4-1","kayenta-2025.4-1","spinnaker-release-2025.4.0","rosco-main-30","rosco-2025.4.0","rosco-2025.4-1","orca-main-68","orca-2025.4.0","orca-2025.4-0","keel-main-31","keel-2025.4.0","keel-2025.4-0","kayenta-main-69","kayenta-2025.4.0","kayenta-2025.4-0","igor-main-36","igor-2025.4.0","igor-2025.4-0","halyard-main-65","halyard-2025.4.0","halyard-2025.4-0","gate-main-46","gate-2025.4.0","gate-2025.4-0","front50-main-34","front50-2025.4.0","front50-2025.4-0","fiat-main-30","fiat-2025.4.0","fiat-2025.4-0","echo-main-37","echo-2025.4.0","echo-2025.4-0","deck-kayenta-2025.4.0","deck-kayenta-2025.4-0","deck-2025.4.0","deck-2025.4-0","clouddriver-main-60","clouddriver-2025.4.0","clouddriver-2025.4-0","bn-spin-release-2025.4.x-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55175.json","vanir_signatures_modified":"2026-08-12T16:09:46Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["189783500143954827564840512148957327910","124507410363285626237473670217753755724","257876403872737649096737577392496580153","63771864032928354262251164101296674974","91762845687979799846018688685280478502","243242807268816930595867524708437310024","99672114260899607499331489452321154594","224660036090184447250662341167747327479","174774372663120727297035595690683865962","178385717207968402440837147305793113963","11927583734478939682361283390006884038","158151225927160518969771948526407345376","174301261975787019707258064749335397870","19126996669015541362370731320659741966","217761696712146463550261247096970587224","99339923461113228624406661532030544162"],"threshold":0.9},"id":"CVE-2026-55175-023d8aec","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java"}},{"id":"CVE-2026-55175-0aa2b7fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java","function":"convert"},"deprecated":false,"digest":{"length":219,"function_hash":"116062769141457025439547019495727232333"}},{"target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java","function":"convert"},"deprecated":false,"digest":{"function_hash":"327925164090947513119813684256426451445","length":228},"id":"CVE-2026-55175-0e30f779","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe"},{"digest":{"function_hash":"234966233154666068892167148775950461773","length":467},"id":"CVE-2026-55175-14f6dfa5","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/a3e1f5e22cb7c78892beed4f795846eb6e12f2e6","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java","function":"sendMessage"},"deprecated":false},{"digest":{"line_hashes":["189783500143954827564840512148957327910","124507410363285626237473670217753755724","257876403872737649096737577392496580153","63771864032928354262251164101296674974","91762845687979799846018688685280478502","243242807268816930595867524708437310024","99672114260899607499331489452321154594","224660036090184447250662341167747327479","174774372663120727297035595690683865962","178385717207968402440837147305793113963","11927583734478939682361283390006884038","158151225927160518969771948526407345376","174301261975787019707258064749335397870","19126996669015541362370731320659741966","217761696712146463550261247096970587224","99339923461113228624406661532030544162"],"threshold":0.9},"id":"CVE-2026-55175-302d9126","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/5aec138dee89abaeecfa782f0bd8b5bdf16d9a55","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java"},"deprecated":false,"digest":{"line_hashes":["244633496895136005442836876144781901820","206302747532622533576234231040268710572","128278766332575750607569768817968144535","95309825138370142821100055205479463873","218073788644275385008463977609925117310","6901424306799913360115441728579596802","248487712364652700010936059692042870386","330774764828865647048286892483185859981","41958492924561858641171244247636884672","166897440502892873621557629105832499466","248020905971105383013141147509514925722","85472008688813742733722193308220806729","221912900417812847992683706901703459260","146413335609183899869208775653824925953","36812818217537956144955015424067008377","334702862094881414077615049126051044476","294368463313409695084634269491421804413","121586338170095282969135356876099859999","202782517570665297713925782494177814630","26870044841817964154308851863592343247","201196223469080516509778026785259274918","269807236269945061561060669326014467624","321441600043239541239886146284561854964","298015502829155290351066687640833141377","278059341685921561639097824148104746476","96687546197617546295344083797077898908","156791970464637933020050584601314972017","311197930335111127392009027251836286829","200068453137501003138442065826282209644","105357940203201968610768961660597512422","146258211800874396243154003951838427197","195343798575061699246385885897669856249","132130660711928510752039486935310324785","36135999705064282932147747083357424926","133745902580411638395115118304691982288","296963025332414878724968891317695007417","50333526524660594606621778476486571969","12968256925246022615136072548453879600","75496682968427887292487410987497222614"],"threshold":0.9},"id":"CVE-2026-55175-30d08785","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/a3e1f5e22cb7c78892beed4f795846eb6e12f2e6","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsClient.java"},"deprecated":false,"digest":{"line_hashes":["329441297168006195216984697805825776667","72860938043372452984936103254394934133","253770407885699064987122572715255690282","194348121243043461055789618435549264370","211623859517572629360176830335795037194","320075850525215119965724928999485517699","194606367712447319350602445672209769967"],"threshold":0.9},"id":"CVE-2026-55175-46572590"},{"target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java"},"deprecated":false,"digest":{"line_hashes":["189783500143954827564840512148957327910","124507410363285626237473670217753755724","257876403872737649096737577392496580153","63771864032928354262251164101296674974","91762845687979799846018688685280478502","243242807268816930595867524708437310024","99672114260899607499331489452321154594","224660036090184447250662341167747327479","174774372663120727297035595690683865962","178385717207968402440837147305793113963","11927583734478939682361283390006884038","158151225927160518969771948526407345376","174301261975787019707258064749335397870","19126996669015541362370731320659741966","217761696712146463550261247096970587224","99339923461113228624406661532030544162"],"threshold":0.9},"id":"CVE-2026-55175-49bc21cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe"},{"id":"CVE-2026-55175-5799ec1a","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java"},"deprecated":false,"digest":{"line_hashes":["189783500143954827564840512148957327910","143130277705883479133331253683010894639","312430606036135915500344015415812922415","13141559813920323127336242315939100933","316686208355967083090065486729149566923","314224686886330280582282627947802700438","91762845687979799846018688685280478502","243242807268816930595867524708437310024","99672114260899607499331489452321154594","224660036090184447250662341167747327479","174774372663120727297035595690683865962","178385717207968402440837147305793113963","11927583734478939682361283390006884038","11700026983437495114529070243430650621","139928325616790341282083797968491516796","73437252324579264829591354570553941033","225277690390393447642779358423289907769"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java","function":"convert"},"deprecated":false,"digest":{"function_hash":"327925164090947513119813684256426451445","length":228},"id":"CVE-2026-55175-5d2f36e4","signature_type":"Function"},{"id":"CVE-2026-55175-61d2e830","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java"},"deprecated":false,"digest":{"line_hashes":["189783500143954827564840512148957327910","124507410363285626237473670217753755724","257876403872737649096737577392496580153","63771864032928354262251164101296674974","91762845687979799846018688685280478502","243242807268816930595867524708437310024","99672114260899607499331489452321154594","224660036090184447250662341167747327479","174774372663120727297035595690683865962","178385717207968402440837147305793113963","11927583734478939682361283390006884038","158151225927160518969771948526407345376","174301261975787019707258064749335397870","19126996669015541362370731320659741966","217761696712146463550261247096970587224","99339923461113228624406661532030544162"],"threshold":0.9}},{"target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java"},"deprecated":false,"digest":{"line_hashes":["244633496895136005442836876144781901820","206302747532622533576234231040268710572","128278766332575750607569768817968144535","95309825138370142821100055205479463873","218073788644275385008463977609925117310","6901424306799913360115441728579596802","248487712364652700010936059692042870386","330774764828865647048286892483185859981","41958492924561858641171244247636884672","166897440502892873621557629105832499466","248020905971105383013141147509514925722","85472008688813742733722193308220806729","221912900417812847992683706901703459260","146413335609183899869208775653824925953","36812818217537956144955015424067008377","334702862094881414077615049126051044476","294368463313409695084634269491421804413","121586338170095282969135356876099859999","202782517570665297713925782494177814630","26870044841817964154308851863592343247","201196223469080516509778026785259274918","269807236269945061561060669326014467624","321441600043239541239886146284561854964","298015502829155290351066687640833141377","278059341685921561639097824148104746476","96687546197617546295344083797077898908","156791970464637933020050584601314972017","311197930335111127392009027251836286829","200068453137501003138442065826282209644","105357940203201968610768961660597512422","146258211800874396243154003951838427197","195343798575061699246385885897669856249","132130660711928510752039486935310324785","36135999705064282932147747083357424926","133745902580411638395115118304691982288","296963025332414878724968891317695007417","50333526524660594606621778476486571969","12968256925246022615136072548453879600","75496682968427887292487410987497222614"],"threshold":0.9},"id":"CVE-2026-55175-66c5e5bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/a3e1f5e22cb7c78892beed4f795846eb6e12f2e6"},{"deprecated":false,"digest":{"function_hash":"234966233154666068892167148775950461773","length":467},"id":"CVE-2026-55175-7daf35c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/9e97bec69d0f8c2e8471276fa79eab88f0536925","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java","function":"sendMessage"}},{"target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java","function":"getRelativePath"},"deprecated":false,"digest":{"function_hash":"121417669775055737212415030206987356174","length":392},"id":"CVE-2026-55175-9e66cdd1","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/5aec138dee89abaeecfa782f0bd8b5bdf16d9a55"},{"digest":{"line_hashes":["329441297168006195216984697805825776667","72860938043372452984936103254394934133","253770407885699064987122572715255690282","194348121243043461055789618435549264370","211623859517572629360176830335795037194","320075850525215119965724928999485517699","194606367712447319350602445672209769967"],"threshold":0.9},"id":"CVE-2026-55175-a0ee8d31","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/5aec138dee89abaeecfa782f0bd8b5bdf16d9a55","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsClient.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/9e97bec69d0f8c2e8471276fa79eab88f0536925","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsClient.java"},"deprecated":false,"digest":{"line_hashes":["329441297168006195216984697805825776667","72860938043372452984936103254394934133","253770407885699064987122572715255690282","194348121243043461055789618435549264370","211623859517572629360176830335795037194","320075850525215119965724928999485517699","194606367712447319350602445672209769967"],"threshold":0.9},"id":"CVE-2026-55175-a9758c95","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/5aec138dee89abaeecfa782f0bd8b5bdf16d9a55","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java","function":"sendMessage"},"deprecated":false,"digest":{"length":467,"function_hash":"234966233154666068892167148775950461773"},"id":"CVE-2026-55175-c2438890","signature_type":"Function"},{"id":"CVE-2026-55175-e14e5cf3","signature_type":"Line","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/9e97bec69d0f8c2e8471276fa79eab88f0536925","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java"},"deprecated":false,"digest":{"line_hashes":["244633496895136005442836876144781901820","206302747532622533576234231040268710572","128278766332575750607569768817968144535","95309825138370142821100055205479463873","218073788644275385008463977609925117310","6901424306799913360115441728579596802","248487712364652700010936059692042870386","330774764828865647048286892483185859981","41958492924561858641171244247636884672","166897440502892873621557629105832499466","248020905971105383013141147509514925722","85472008688813742733722193308220806729","221912900417812847992683706901703459260","146413335609183899869208775653824925953","36812818217537956144955015424067008377","334702862094881414077615049126051044476","294368463313409695084634269491421804413","121586338170095282969135356876099859999","202782517570665297713925782494177814630","26870044841817964154308851863592343247","201196223469080516509778026785259274918","269807236269945061561060669326014467624","321441600043239541239886146284561854964","298015502829155290351066687640833141377","278059341685921561639097824148104746476","96687546197617546295344083797077898908","156791970464637933020050584601314972017","311197930335111127392009027251836286829","200068453137501003138442065826282209644","105357940203201968610768961660597512422","146258211800874396243154003951838427197","195343798575061699246385885897669856249","132130660711928510752039486935310324785","36135999705064282932147747083357424926","133745902580411638395115118304691982288","296963025332414878724968891317695007417","50333526524660594606621778476486571969","12968256925246022615136072548453879600","75496682968427887292487410987497222614"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"121417669775055737212415030206987356174","length":392},"id":"CVE-2026-55175-e9bf7533","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/a3e1f5e22cb7c78892beed4f795846eb6e12f2e6","target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java","function":"getRelativePath"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7","target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java","function":"convert"},"deprecated":false,"digest":{"function_hash":"327925164090947513119813684256426451445","length":228},"id":"CVE-2026-55175-f37f5ddb"},{"target":{"file":"echo/echo-notifications/src/main/java/com/netflix/spinnaker/echo/microsoftteams/MicrosoftTeamsService.java","function":"getRelativePath"},"deprecated":false,"digest":{"function_hash":"121417669775055737212415030206987356174","length":392},"id":"CVE-2026-55175-f3f976dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/9e97bec69d0f8c2e8471276fa79eab88f0536925"},{"target":{"file":"rosco/rosco-manifests/src/main/java/com/netflix/spinnaker/rosco/manifests/kustomize/KustomizationFileReader.java","function":"convert"},"deprecated":false,"digest":{"function_hash":"327925164090947513119813684256426451445","length":228},"id":"CVE-2026-55175-fcdc71cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}