ghsa-p68j-q7hf-3qcp
CVSS 7.5 osv_maven
Description
### Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider. ### Workarounds Disable kustomize bakes
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-55175
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
- https://github.com/spinnaker/spinnaker
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1
- https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"
},
"package": {
"ecosystem": "Maven",
"name": "io.spinnaker.rosco:rosco-manifests",
"purl": "pkg:maven/io.spinnaker.rosco/rosco-manifests"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.3.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.10.0",
"1.11.0",
"1.12.0",
"1.12.1",
"1.12.2",
"1.12.3",
"1.12.4",
"1.13.0",
"1.13.1",
"1.13.2",
"1.13.3",
"1.13.4",
"1.14.0",
"1.15.0",
"1.16.0",
"1.17.0",
"1.17.1",
"1.17.2",
"1.18.0",
"1.18.1",
"1.18.2",
"1.19.0",
"1.19.1",
"1.20.0",
"1.20.1",
"1.20.2",
"1.20.3",
"1.21.0",
"1.21.1",
"1.22.0",
"1.22.1",
"1.22.2",
"1.23.0",
"1.23.1",
"1.24.0",
"1.25.0",
"1.26.0",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"1.8.0",
"1.8.0-rc.1",
"1.8.0-rc.10",
"1.8.0-rc.11",
"1.8.0-rc.12",
"1.8.0-rc.2",
"1.8.0-rc.3",
"1.8.0-rc.4",
"1.8.0-rc.5",
"1.8.0-rc.6",
"1.8.0-rc.7",
"1.8.0-rc.8",
"1.8.0-rc.9",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.4",
"1.8.5",
"1.8.6",
"1.8.7",
"1.9.0",
"2025.0-0",
"2025.0-1",
"2025.0-10",
"2025.0-11",
"2025.0-12",
"2025.0-13",
"2025.0-14",
"2025.0-15",
"2025.0-16",
"2025.0-17",
"2025.0-18",
"2025.0-19",
"2025.0-2",
"2025.0-20",
"2025.0-21",
"2025.0-22",
"2025.0-23",
"2025.0-24",
"2025.0-25",
"2025.0-3",
"2025.0-4",
"2025.0-5",
"2025.0-6",
"2025.0-7",
"2025.0-8",
"2025.0-9",
"2025.0.0",
"2025.0.1",
"2025.0.2",
"2025.0.3",
"2025.0.4",
"2025.0.5",
"2025.0.6",
"2025.0.7",
"2025.0.8",
"2025.1-0",
"2025.1-1",
"2025.1-10",
"2025.1-11",
"2025.1-12",
"2025.1-13",
"2025.1-14",
"2025.1-15",
"2025.1-16",
"2025.1-17",
"2025.1-18",
"2025.1-19",
"2025.1-2",
"2025.1-20",
"2025.1-21",
"2025.1-22",
"2025.1-3",
"2025.1-4",
"2025.1-5",
"2025.1-6",
"2025.1-7",
"2025.1-8",
"2025.1-9",
"2025.1.0",
"2025.1.1",
"2025.1.2",
"2025.1.3",
"2025.1.4",
"2025.1.5",
"2025.1.6",
"2025.2-0",
"2025.2-1",
"2025.2-10",
"2025.2-11",
"2025.2-12",
"2025.2-13",
"2025.2-14",
"2025.2-15",
"2025.2-16",
"2025.2-2",
"2025.2-3",
"2025.2-4",
"2025.2-5",
"2025.2-6",
"2025.2-7",
"2025.2-8",
"2025.2-9",
"2025.2.0",
"2025.2.1",
"2025.2.2",
"2025.2.3",
"2025.2.4",
"2025.3-0",
"2025.3-1",
"2025.3-11",
"2025.3-12",
"2025.3-2",
"2025.3-3",
"2025.3-4",
"2025.3-5",
"2025.3-6",
"2025.3-7",
"2025.3-8",
"2025.3-9",
"2025.3.0",
"2025.3.1",
"2025.3.2",
"2025.3.3",
"main-10",
"main-100",
"main-101",
"main-102",
"main-103",
"main-104",
"main-105",
"main-107",
"main-108",
"main-109",
"main-11",
"main-110",
"main-111",
"main-112",
"main-113",
"main-114",
"main-115",
"main-116",
"main-117",
"main-118",
"main-119",
"main-12",
"main-120",
"main-121",
"main-122",
"main-123",
"main-124",
"main-125",
"main-126",
"main-127",
"main-128",
"main-129",
"main-13",
"main-130",
"main-131",
"main-132",
"main-133",
"main-134",
"main-135",
"main-136",
"main-137",
"main-138",
"main-139",
"main-14",
"main-140",
"main-141",
"main-142",
"main-143",
"main-144",
"main-145",
"main-146",
"main-147",
"main-148",
"main-149",
"main-15",
"main-150",
"main-151",
"main-152",
"main-153",
"main-154",
"main-155",
"main-156",
"main-157",
"main-158",
"main-159",
"main-16",
"main-160",
"main-161",
"main-162",
"main-163",
"main-164",
"main-165",
"main-166",
"main-167",
"main-168",
"main-169",
"main-17",
"main-170",
"main-171",
"main-172",
"main-173",
"main-174",
"main-175",
"main-176",
"main-177",
"main-178",
"main-179",
"main-18",
"main-180",
"main-181",
"main-182",
"main-183",
"main-184",
"main-185",
"main-186",
"main-187",
"main-188",
"main-189",
"main-19",
"main-190",
"main-191",
"main-192",
"main-193",
"main-194",
"main-195",
"main-196",
"main-197",
"main-198",
"main-199",
"main-20",
"main-200",
"main-201",
"main-202",
"main-203",
"main-204",
"main-205",
"main-206",
"main-207",
"main-208",
"main-209",
"main-21",
"main-210",
"main-211",
"main-212",
"main-213",
"main-214",
"main-215",
"main-216",
"main-217",
"main-218",
"main-219",
"main-22",
"main-220",
"main-221",
"main-222",
"main-223",
"main-224",
"main-225",
"main-226",
"main-227",
"main-228",
"main-229",
"main-23",
"main-230",
"main-231",
"main-232",
"main-233",
"main-234",
"main-235",
"main-236",
"main-237",
"main-239",
"main-24",
"main-241",
"main-272",
"main-273",
"main-274",
"main-275",
"main-276",
"main-277",
"main-278",
"main-279",
"main-280",
"main-281",
"main-282",
"main-283",
"main-284",
"main-285",
"main-286",
"main-287",
"main-288",
"main-289",
"main-290",
"main-291",
"main-292",
"main-293",
"main-294",
"main-295",
"main-296",
"main-297",
"main-298",
"main-299",
"main-30",
"main-300",
"main-301",
"main-302",
"main-303",
"main-304",
"main-305",
"main-306",
"main-307",
"main-308",
"main-309",
"main-31",
"main-310",
"main-311",
"main-312",
"main-313",
"main-314",
"main-315",
"main-316",
"main-317",
"main-318",
"main-319",
"main-32",
"main-320",
"main-321",
"main-322",
"main-323",
"main-324",
"main-325",
"main-326",
"main-327",
"main-328",
"main-329",
"main-33",
"main-330",
"main-331",
"main-332",
"main-333",
"main-334",
"main-335",
"main-336",
"main-337",
"main-34",
"main-35",
"main-36",
"main-37",
"main-38",
"main-39",
"main-40",
"main-41",
"main-42",
"main-43",
"main-44",
"main-45",
"main-46",
"main-47",
"main-48",
"main-49",
"main-5",
"main-50",
"main-51",
"main-52",
"main-53",
"main-54",
"main-55",
"main-56",
"main-57",
"main-58",
"main-59",
"main-6",
"main-60",
"main-61",
"main-62",
"main-63",
"main-64",
"main-65",
"main-66",
"main-67",
"main-68",
"main-69",
"main-7",
"main-70",
"main-71",
"main-72",
"main-73",
"main-74",
"main-75",
"main-76",
"main-77",
"main-78",
"main-79",
"main-8",
"main-80",
"main-81",
"main-84",
"main-85",
"main-86",
"main-87",
"main-88",
"main-89",
"main-9",
"main-90",
"main-91",
"main-92",
"main-93",
"main-94",
"main-95",
"main-96",
"main-97",
"main-98",
"main-99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"
},
"package": {
"ecosystem": "Maven",
"name": "io.spinnaker.rosco:rosco-manifests",
"purl": "pkg:maven/io.spinnaker.rosco/rosco-manifests"
},
"ranges": [
{
"events": [
{
"introduced": "2025.4.0"
},
{
"fixed": "2025.4.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2025.4-0",
"2025.4-1",
"2025.4-10",
"2025.4-11",
"2025.4-12",
"2025.4-13",
"2025.4-14",
"2025.4-15",
"2025.4-16",
"2025.4-17",
"2025.4-18",
"2025.4-19",
"2025.4-2",
"2025.4-20",
"2025.4-21",
"2025.4-3",
"2025.4-4",
"2025.4-5",
"2025.4-6",
"2025.4-7",
"2025.4-8",
"2025.4-9",
"2025.4.0",
"2025.4.1",
"2025.4.2",
"2025.4.3"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"
},
"package": {
"ecosystem": "Maven",
"name": "io.spinnaker.rosco:rosco-manifests",
"purl": "pkg:maven/io.spinnaker.rosco/rosco-manifests"
},
"ranges": [
{
"events": [
{
"introduced": "2026.0.0"
},
{
"fixed": "2026.0.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2026.0-0",
"2026.0-1",
"2026.0-10",
"2026.0-11",
"2026.0-12",
"2026.0-13",
"2026.0-14",
"2026.0-15",
"2026.0-16",
"2026.0-17",
"2026.0-18",
"2026.0-19",
"2026.0-2",
"2026.0-20",
"2026.0-21",
"2026.0-22",
"2026.0-23",
"2026.0-3",
"2026.0-4",
"2026.0-5",
"2026.0-6",
"2026.0-7",
"2026.0-8",
"2026.0-9",
"2026.0.0",
"2026.0.1",
"2026.0.2"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"
},
"package": {
"ecosystem": "Maven",
"name": "io.spinnaker.rosco:rosco-manifests",
"purl": "pkg:maven/io.spinnaker.rosco/rosco-manifests"
},
"ranges": [
{
"events": [
{
"introduced": "2026.1.0"
},
{
"fixed": "2026.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2026.1-0",
"2026.1-1",
"2026.1-10",
"2026.1-11",
"2026.1-12",
"2026.1-13",
"2026.1-14",
"2026.1-2",
"2026.1-3",
"2026.1-4",
"2026.1-5",
"2026.1-6",
"2026.1-7",
"2026.1-8",
"2026.1-9",
"2026.1.0"
]
}
],
"aliases": [
"CVE-2026-55175"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T18:35:06Z",
"nvd_published_at": "2026-07-10T23:16:48Z",
"severity": "HIGH"
},
"details": "### Impact\nKustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.\n\n### Workarounds\nDisable kustomize bakes",
"id": "GHSA-p68j-q7hf-3qcp",
"modified": "2026-09-10T03:51:14.688449229Z",
"published": "2026-08-28T18:35:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55175"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f"
},
{
"type": "PACKAGE",
"url": "https://github.com/spinnaker/spinnaker"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1"
},
{
"type": "WEB",
"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0"
}
],
"schema_version": "1.9.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Spinnaker: Improper yaml processing on kustomize bake operations"
}