{"id":"GHSA-c8q4-9h32-2ww8","summary":"Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types","details":"### Impact\nThere's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:\n* CloudFormation deployments\n* CloudFoundry Baking\n\nThe usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.\n\n### Patches\n 2025.3.3, 2026.0.3 and 2025.4.4.\n\n### Workarounds\nDisable the CloudFormation system and cloudfoundry baking operations.\n\n### Resources\nJoin Spinnaker on Slack for more information!","aliases":["CVE-2026-44795"],"modified":"2026-09-10T03:51:08.726265701Z","published":"2026-06-22T20:43:37Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-22T20:43:37Z","nvd_published_at":"2026-07-10T22:16:41Z","cwe_ids":["CWE-470","CWE-502"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-c8q4-9h32-2ww8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44795"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/4cbe1d5fea9df573aadfd8b093fb4b594b354ee5"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/e57c0db4584b398473a7bbb19402ce6c1e89b627"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/f69d7b534d068ed74d0d3a1fbf17e2c945d36e5e"},{"type":"PACKAGE","url":"https://github.com/spinnaker/spinnaker"}],"affected":[{"package":{"name":"io.spinnaker.rosco:rosco-core","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.rosco/rosco-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.3.3"}]}],"versions":["1.10.0","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.14.0","1.15.0","1.16.0","1.17.0","1.17.1","1.17.2","1.18.0","1.18.1","1.18.2","1.19.0","1.19.1","1.20.0","1.20.1","1.20.2","1.20.3","1.21.0","1.21.1","1.22.0","1.22.1","1.22.2","1.23.0","1.23.1","1.24.0","1.25.0","1.26.0","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.8.0","1.8.0-rc.1","1.8.0-rc.10","1.8.0-rc.11","1.8.0-rc.12","1.8.0-rc.2","1.8.0-rc.3","1.8.0-rc.4","1.8.0-rc.5","1.8.0-rc.6","1.8.0-rc.7","1.8.0-rc.8","1.8.0-rc.9","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","2025.0-0","2025.0-1","2025.0-10","2025.0-11","2025.0-12","2025.0-13","2025.0-14","2025.0-15","2025.0-16","2025.0-17","2025.0-18","2025.0-19","2025.0-2","2025.0-20","2025.0-21","2025.0-22","2025.0-23","2025.0-24","2025.0-25","2025.0-3","2025.0-4","2025.0-5","2025.0-6","2025.0-7","2025.0-8","2025.0-9","2025.0.0","2025.0.1","2025.0.2","2025.0.3","2025.0.4","2025.0.5","2025.0.6","2025.0.7","2025.0.8","2025.1-0","2025.1-1","2025.1-10","2025.1-11","2025.1-12","2025.1-13","2025.1-14","2025.1-15","2025.1-16","2025.1-17","2025.1-18","2025.1-19","2025.1-2","2025.1-20","2025.1-21","2025.1-22","2025.1-3","2025.1-4","2025.1-5","2025.1-6","2025.1-7","2025.1-8","2025.1-9","2025.1.0","2025.1.1","2025.1.2","2025.1.3","2025.1.4","2025.1.5","2025.1.6","2025.2-0","2025.2-1","2025.2-10","2025.2-11","2025.2-12","2025.2-13","2025.2-14","2025.2-15","2025.2-16","2025.2-2","2025.2-3","2025.2-4","2025.2-5","2025.2-6","2025.2-7","2025.2-8","2025.2-9","2025.2.0","2025.2.1","2025.2.2","2025.2.3","2025.2.4","2025.3-0","2025.3-1","2025.3-11","2025.3-12","2025.3-2","2025.3-3","2025.3-4","2025.3-5","2025.3-6","2025.3-7","2025.3-8","2025.3-9","2025.3.0","2025.3.1","2025.3.2","main-10","main-100","main-101","main-102","main-103","main-104","main-105","main-107","main-108","main-109","main-11","main-110","main-111","main-112","main-113","main-114","main-115","main-116","main-117","main-118","main-119","main-12","main-120","main-121","main-122","main-123","main-124","main-125","main-126","main-127","main-128","main-129","main-13","main-130","main-131","main-132","main-133","main-134","main-135","main-136","main-137","main-138","main-139","main-14","main-140","main-141","main-142","main-143","main-144","main-145","main-146","main-147","main-148","main-149","main-15","main-150","main-151","main-152","main-153","main-154","main-155","main-156","main-157","main-158","main-159","main-16","main-160","main-161","main-162","main-163","main-164","main-165","main-166","main-167","main-168","main-169","main-17","main-170","main-171","main-172","main-173","main-174","main-175","main-176","main-177","main-178","main-179","main-18","main-180","main-181","main-182","main-183","main-184","main-185","main-186","main-187","main-188","main-189","main-19","main-190","main-191","main-192","main-193","main-194","main-195","main-196","main-197","main-198","main-199","main-20","main-200","main-201","main-202","main-203","main-204","main-205","main-206","main-207","main-208","main-209","main-21","main-210","main-211","main-212","main-213","main-214","main-215","main-216","main-217","main-218","main-219","main-22","main-220","main-221","main-222","main-223","main-224","main-225","main-226","main-227","main-228","main-229","main-23","main-230","main-231","main-232","main-233","main-234","main-235","main-236","main-237","main-239","main-24","main-241","main-272","main-273","main-274","main-275","main-276","main-277","main-278","main-279","main-280","main-281","main-282","main-283","main-284","main-285","main-286","main-287","main-288","main-289","main-290","main-291","main-292","main-293","main-294","main-295","main-296","main-297","main-298","main-299","main-30","main-300","main-301","main-302","main-303","main-304","main-305","main-306","main-307","main-308","main-309","main-31","main-310","main-311","main-312","main-313","main-314","main-315","main-316","main-317","main-318","main-319","main-32","main-320","main-321","main-322","main-323","main-324","main-325","main-326","main-327","main-328","main-329","main-33","main-330","main-331","main-332","main-333","main-334","main-335","main-336","main-337","main-34","main-35","main-36","main-37","main-38","main-39","main-40","main-41","main-42","main-43","main-44","main-45","main-46","main-47","main-48","main-49","main-5","main-50","main-51","main-52","main-53","main-54","main-55","main-56","main-57","main-58","main-59","main-6","main-60","main-61","main-62","main-63","main-64","main-65","main-66","main-67","main-68","main-69","main-7","main-70","main-71","main-72","main-73","main-74","main-75","main-76","main-77","main-78","main-79","main-8","main-80","main-81","main-84","main-85","main-86","main-87","main-88","main-89","main-9","main-90","main-91","main-92","main-93","main-94","main-95","main-96","main-97","main-98","main-99"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json"}},{"package":{"name":"io.spinnaker.orca:orca-core","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.orca/orca-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.3.3"}]}],"versions":["2025.0-0","2025.0-1","2025.0-10","2025.0-12","2025.0-13","2025.0-14","2025.0-15","2025.0-16","2025.0-17","2025.0-18","2025.0-19","2025.0-2","2025.0-20","2025.0-21","2025.0-22","2025.0-23","2025.0-24","2025.0-25","2025.0-3","2025.0-4","2025.0-5","2025.0-6","2025.0-7","2025.0-8","2025.0-9","2025.0.0","2025.0.1","2025.0.2","2025.0.3","2025.0.4","2025.0.5","2025.0.6","2025.0.7","2025.0.8","2025.1-0","2025.1-1","2025.1-10","2025.1-11","2025.1-12","2025.1-13","2025.1-14","2025.1-15","2025.1-16","2025.1-17","2025.1-18","2025.1-19","2025.1-2","2025.1-20","2025.1-21","2025.1-22","2025.1-3","2025.1-4","2025.1-5","2025.1-6","2025.1-7","2025.1-8","2025.1-9","2025.1.0","2025.1.1","2025.1.2","2025.1.3","2025.1.4","2025.1.5","2025.1.6","2025.2-0","2025.2-1","2025.2-10","2025.2-11","2025.2-12","2025.2-13","2025.2-14","2025.2-15","2025.2-16","2025.2-2","2025.2-3","2025.2-4","2025.2-5","2025.2-6","2025.2-7","2025.2-8","2025.2-9","2025.2.0","2025.2.1","2025.2.2","2025.2.3","2025.2.4","2025.3-0","2025.3-1","2025.3-10","2025.3-11","2025.3-12","2025.3-2","2025.3-3","2025.3-4","2025.3-5","2025.3-6","2025.3-7","2025.3-8","2025.3-9","2025.3.0","2025.3.1","2025.3.2","8.15.0","8.16.0","8.17.1","8.18.0","8.18.10","8.18.11","8.18.2","8.18.3","8.18.4","8.18.5","8.18.6","8.18.7","8.18.8","8.18.9","8.20.0","8.21.0","8.22.0","8.23.0","8.24.1","8.24.2","8.24.3","8.24.4","8.24.5","8.24.6","8.24.7","8.24.8","8.24.9","8.25.0","8.26.0","8.27.0","8.27.1","8.27.2","8.27.3","8.27.4","8.27.5","8.27.6","8.28.0","8.29.0","8.30.0","8.31.0","8.31.1","8.31.2","8.31.3","8.31.4","8.31.5","8.31.6","8.32.0","8.33.0","8.33.1","8.33.2","8.34.0","8.35.0","8.36.0","8.36.1","8.36.2","8.37.0","8.38.0","8.39.0","8.40.0","8.41.0","8.42.0","8.44.0","8.45.0","8.47.0","8.48.0","8.48.1","8.48.2","8.48.3","8.49.0","8.50.0","8.51.0","8.51.1","8.51.2","8.51.3","8.52.0","8.53.0","8.54.0","8.54.1","8.55.0","8.56.0","8.57.0","8.57.1","8.57.2","8.58.0","8.59.0","8.60.0","8.61.0","8.61.1","8.61.2","8.62.0","8.63.0","8.64.0","main-10","main-100","main-101","main-102","main-103","main-104","main-105","main-106","main-107","main-108","main-109","main-11","main-110","main-111","main-113","main-114","main-115","main-116","main-117","main-118","main-119","main-12","main-120","main-121","main-122","main-123","main-124","main-125","main-126","main-127","main-128","main-129","main-13","main-130","main-131","main-132","main-133","main-134","main-135","main-136","main-137","main-138","main-139","main-14","main-140","main-141","main-142","main-143","main-144","main-145","main-146","main-147","main-148","main-149","main-15","main-150","main-151","main-152","main-153","main-154","main-155","main-156","main-157","main-158","main-159","main-16","main-160","main-161","main-162","main-163","main-164","main-165","main-166","main-167","main-168","main-169","main-17","main-170","main-171","main-172","main-173","main-174","main-175","main-176","main-177","main-178","main-179","main-18","main-180","main-181","main-182","main-183","main-184","main-185","main-186","main-187","main-188","main-189","main-19","main-190","main-191","main-192","main-193","main-194","main-195","main-196","main-197","main-198","main-199","main-20","main-200","main-201","main-202","main-203","main-204","main-205","main-206","main-207","main-208","main-209","main-21","main-210","main-211","main-212","main-213","main-214","main-215","main-216","main-217","main-218","main-219","main-22","main-220","main-222","main-223","main-224","main-225","main-226","main-227","main-228","main-229","main-23","main-230","main-231","main-232","main-233","main-234","main-235","main-236","main-237","main-239","main-24","main-241","main-245","main-246","main-247","main-248","main-249","main-250","main-251","main-252","main-253","main-254","main-255","main-256","main-257","main-258","main-259","main-260","main-261","main-262","main-263","main-264","main-265","main-266","main-267","main-268","main-269","main-270","main-271","main-272","main-273","main-274","main-275","main-277","main-278","main-279","main-280","main-281","main-282","main-283","main-284","main-285","main-286","main-287","main-288","main-289","main-290","main-291","main-292","main-293","main-294","main-295","main-296","main-297","main-298","main-299","main-30","main-300","main-301","main-302","main-303","main-304","main-305","main-306","main-307","main-308","main-309","main-31","main-310","main-311","main-312","main-313","main-314","main-315","main-316","main-317","main-318","main-319","main-32","main-320","main-321","main-322","main-323","main-324","main-325","main-326","main-327","main-328","main-329","main-33","main-330","main-331","main-332","main-333","main-334","main-335","main-336","main-337","main-34","main-35","main-36","main-37","main-38","main-39","main-40","main-41","main-42","main-43","main-44","main-45","main-46","main-47","main-48","main-49","main-5","main-50","main-51","main-52","main-53","main-54","main-55","main-56","main-57","main-58","main-59","main-6","main-60","main-61","main-62","main-63","main-64","main-65","main-66","main-67","main-68","main-69","main-7","main-70","main-71","main-72","main-73","main-74","main-75","main-76","main-77","main-78","main-79","main-8","main-80","main-81","main-84","main-85","main-86","main-87","main-88","main-89","main-9","main-90","main-91","main-92","main-93","main-94","main-95","main-96","main-97","main-98","main-99"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json"}},{"package":{"name":"io.spinnaker.rosco:rosco-core","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.rosco/rosco-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2025.4.0"},{"fixed":"2025.4.4"}]}],"versions":["2025.4-0","2025.4-1","2025.4-10","2025.4-11","2025.4-12","2025.4-13","2025.4-14","2025.4-15","2025.4-16","2025.4-17","2025.4-18","2025.4-19","2025.4-2","2025.4-20","2025.4-21","2025.4-3","2025.4-4","2025.4-5","2025.4-6","2025.4-7","2025.4-8","2025.4-9","2025.4.0","2025.4.1","2025.4.2","2025.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json"}},{"package":{"name":"io.spinnaker.rosco:rosco-core","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.rosco/rosco-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2026.0.0"},{"fixed":"2026.0.3"}]}],"versions":["2026.0-0","2026.0-1","2026.0-10","2026.0-11","2026.0-12","2026.0-13","2026.0-14","2026.0-15","2026.0-16","2026.0-17","2026.0-18","2026.0-19","2026.0-2","2026.0-20","2026.0-21","2026.0-22","2026.0-23","2026.0-3","2026.0-4","2026.0-5","2026.0-6","2026.0-7","2026.0-8","2026.0-9","2026.0.0","2026.0.1","2026.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json"}},{"package":{"name":"io.spinnaker.orca:orca-core","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.orca/orca-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2025.4.0"},{"fixed":"2025.4.4"}]}],"versions":["2025.4-0","2025.4-1","2025.4-10","2025.4-11","2025.4-12","2025.4-13","2025.4-14","2025.4-15","2025.4-16","2025.4-17","2025.4-18","2025.4-19","2025.4-2","2025.4-20","2025.4-21","2025.4-3","2025.4-4","2025.4-5","2025.4-6","2025.4-7","2025.4-8","2025.4-9","2025.4.0","2025.4.1","2025.4.2","2025.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json"}},{"package":{"name":"io.spinnaker.orca:orca-core","ecosystem":"Maven","purl":"pkg:maven/io.spinnaker.orca/orca-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2026.0.0"},{"fixed":"2026.0.3"}]}],"versions":["2026.0-0","2026.0-1","2026.0-10","2026.0-11","2026.0-12","2026.0-13","2026.0-14","2026.0-15","2026.0-16","2026.0-17","2026.0-18","2026.0-19","2026.0-2","2026.0-20","2026.0-21","2026.0-22","2026.0-23","2026.0-3","2026.0-4","2026.0-5","2026.0-6","2026.0-7","2026.0-8","2026.0-9","2026.0.0","2026.0.1","2026.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"}]}