Executive brief
Spinnaker is an open-source platform used by organizations to manage software deployments across multiple cloud providers. A security vulnerability in how the platform handles configuration files (YAML) could allow an attacker to execute malicious code on the server. This could lead to a full system takeover, unauthorized access to cloud infrastructure, or the theft of sensitive deployment credentials.
Technical details
A deserialization vulnerability exists in Spinnaker due to the use of unsafe YAML constructors during CloudFormation deployments and CloudFoundry baking processes. The root cause is the failure to use safe constructors in specific Java classes, which allows an attacker to supply externally-controlled input to select and load arbitrary Java classes (CWE-470). By providing a specially crafted YAML payload, a remote attacker with low privileges can achieve arbitrary code execution (RCE) on the Spinnaker instance. The issue has been addressed by migrating to safe YAML constructors in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.
Affected products
- Spinnaker Spinnaker < 2025.3.3, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3, < 2026.1.0
Timeline
- 2026-07-10: advisory
- 2026-05-26: patched: Backport commits applied to various release branches.
References
- https://github.com/spinnaker/spinnaker/commit/4cbe1d5fea9df573aadfd8b093fb4b594b354ee5
- https://github.com/spinnaker/spinnaker/commit/e57c0db4584b398473a7bbb19402ce6c1e89b627
- https://github.com/spinnaker/spinnaker/commit/f69d7b534d068ed74d0d3a1fbf17e2c945d36e5e
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-c8q4-9h32-2ww8