CVE-2026-55175: Spinnaker remote code execution in Rosco Kustomize bakes

CVE-2026-55175 · Severity: high · CVSS 7.5 · Published 2026-07-10

Spinnaker Rosco is a component responsible for baking machine images and manifests in deployment pipelines. The Kustomize templating feature in Rosco improperly processes YAML tags, allowing an authenticated user to inject code that executes on the Rosco service pods. This can lead to complete compromise of the image-building infrastructure and potential lateral movement through the deployment pipeline.

Vendors: Maven.

Quick answers

Is CVE-2026-55175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55175 being exploited in the wild.
How severe is CVE-2026-55175?
High severity, with a CVSS score of 7.5, published 10 July 2026.
Which products and versions are affected?
io.spinnaker.rosco:rosco-manifests (Maven) ECOSYSTEM:introduced=0,fixed=2025.3.4; Spinnaker Rosco < 2025.3.4, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3, >= 2026.1.0 < 2026.1.1; Spinnaker < 2025.3.4, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3, >= 2026.1.0 < 2026.1.1.
Is there a fix for CVE-2026-55175?
Yes. io.spinnaker.rosco:rosco-manifests (Maven): upgrade to 2025.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55175 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55175?
Check whether you run io.spinnaker.rosco:rosco-manifests (Maven), Spinnaker Rosco or Spinnaker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.spinnaker.rosco:rosco-manifests (Maven): upgrade to 2025.3.4 or later
    # set io.spinnaker.rosco:rosco-manifests to 2025.3.4 in your pom.xml or build.gradle

Technical details

This vulnerability stems from improper YAML deserialization in Kustomize bake operations (CWE-502), where unsafe tag processing allows remote code execution. The vulnerability requires low privileges and network access but has high attack complexity. An attacker must be authenticated to trigger Kustomize bake operations, but no user interaction is required once authenticated. By crafting malicious Kustomize configurations with unsafe YAML tags, an attacker can execute arbitrary code on the Rosco pod, achieving full code execution with the privileges of the Rosco service. Patches are available across all affected version branches: 2025.3.4, 2025.4.4, 2026.0.3, and 2026.1.1. The vulnerability is mitigated by disabling Kustomize bake operations and using alternative templating providers.

Affected products

  • Spinnaker Rosco < 2025.3.4, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3, >= 2026.1.0 < 2026.1.1

Identifiers

  • CVE-2026-55175
  • GHSA-p68j-q7hf-3qcp

Timeline

  • 2026-07-06: disclosed
  • 2026-08-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.