CVE-2026-55175

{"id": "CVE-2026-55175", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55175", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "spinnaker", "product": "spinnaker", "versions": [{"status": "affected", "version": ">= 2026.1.0, < 2026.1.1"}, {"status": "affected", "version": ">= 2026.0.0, < 2026.0.3"}, {"status": "affected", "version": ">= 2025.4.0, < 2025.4.4"}, {"status": "affected", "version": "< 2025.3.4"}]}]}], "published": "2026-07-10T23:16:48.487", "references": [{"url": "https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4."}], "lastModified": "2026-07-21T19:25:45.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7491740-4435-4B7D-9047-F801E452D1CC", "versionEndExcluding": "2025.3.4", "versionStartIncluding": "2025.3.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E98DF9E-C9BC-4809-9F05-0612F4C6455A", "versionEndExcluding": "2025.4.4", "versionStartIncluding": "2025.4.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27341D21-DE6A-4BFC-84E4-1A67CFBF20D5", "versionEndExcluding": "2026.0.3", "versionStartIncluding": "2026.0.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0857BF9B-A1CD-42FE-A7B7-47BB3355D9F7", "versionEndExcluding": "2026.1.1", "versionStartIncluding": "2026.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}