CVE-2026-44795: Spinnaker RCE via unsafe YAML deserialization

CVE-2026-44795 · Severity: high · CVSS 8.8 · Published 2026-07-10

Spinnaker is an open-source platform used by organizations to manage software deployments across multiple cloud providers. A security vulnerability in how the platform handles configuration files (YAML) could allow an attacker to execute malicious code on the server. This could lead to a full system takeover, unauthorized access to cloud infrastructure, or the theft of sensitive deployment credentials.

Vendors: Maven.

Quick answers

Is CVE-2026-44795 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44795 being exploited in the wild.
How severe is CVE-2026-44795?
High severity, with a CVSS score of 8.8, published 10 July 2026.
Which products and versions are affected?
io.spinnaker.orca:orca-core (Maven) ECOSYSTEM:introduced=0,fixed=2025.3.3; io.spinnaker.rosco:rosco-core (Maven) ECOSYSTEM:introduced=0,fixed=2025.3.3; Spinnaker Orca < 2025.3.3, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3; Spinnaker Rosco < 2025.3.3, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3; and 1 more.
Is there a fix for CVE-2026-44795?
Yes. io.spinnaker.orca:orca-core (Maven): upgrade to 2025.3.3 or later; io.spinnaker.rosco:rosco-core (Maven): upgrade to 2025.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44795 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44795?
Check whether you run io.spinnaker.orca:orca-core (Maven), io.spinnaker.rosco:rosco-core (Maven), Spinnaker Orca or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.spinnaker.orca:orca-core (Maven): upgrade to 2025.3.3 or later
    # set io.spinnaker.orca:orca-core to 2025.3.3 in your pom.xml or build.gradle
  • io.spinnaker.rosco:rosco-core (Maven): upgrade to 2025.3.3 or later
    # set io.spinnaker.rosco:rosco-core to 2025.3.3 in your pom.xml or build.gradle

Technical details

A deserialization vulnerability exists in Spinnaker due to the use of unsafe YAML constructors during CloudFormation deployments and CloudFoundry baking processes. The root cause is the failure to use safe constructors in specific Java classes, which allows an attacker to supply externally-controlled input to select and load arbitrary Java classes (CWE-470). By providing a specially crafted YAML payload, a remote attacker with low privileges can achieve arbitrary code execution (RCE) on the Spinnaker instance. The issue has been addressed by migrating to safe YAML constructors in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

Affected products

  • Spinnaker Spinnaker < 2025.3.3, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3, < 2026.1.0

Identifiers

  • CVE-2026-44795
  • GHSA-c8q4-9h32-2ww8

Timeline

  • 2026-07-10: advisory
  • 2026-05-26: patched: Backport commits applied to various release branches.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.