CVE-2026-55175: Spinnaker remote code execution in Rosco Kustomize bakes

Executive brief

Spinnaker Rosco is a component responsible for baking machine images and manifests in deployment pipelines. The Kustomize templating feature in Rosco improperly processes YAML tags, allowing an authenticated user to inject code that executes on the Rosco service pods. This can lead to complete compromise of the image-building infrastructure and potential lateral movement through the deployment pipeline.

Technical details

This vulnerability stems from improper YAML deserialization in Kustomize bake operations (CWE-502), where unsafe tag processing allows remote code execution. The vulnerability requires low privileges and network access but has high attack complexity. An attacker must be authenticated to trigger Kustomize bake operations, but no user interaction is required once authenticated. By crafting malicious Kustomize configurations with unsafe YAML tags, an attacker can execute arbitrary code on the Rosco pod, achieving full code execution with the privileges of the Rosco service. Patches are available across all affected version branches: 2025.3.4, 2025.4.4, 2026.0.3, and 2026.1.1. The vulnerability is mitigated by disabling Kustomize bake operations and using alternative templating providers.

Affected products

• Spinnaker Rosco < 2025.3.4, >= 2025.4.0 < 2025.4.4, >= 2026.0.0 < 2026.0.3, >= 2026.1.0 < 2026.1.1

Timeline

• 2026-07-06: disclosed
• 2026-08-28: advisory

References

• https://api.github.com/users/thesecguy45
• https://github.com/thesecguy45
• https://api.github.com/users/thesecguy45/gists%7B/gist_id%7D
• https://api.github.com/users/thesecguy45/repos
• https://avatars.githubusercontent.com/u/227870317?v=4
• https://api.github.com/users/thesecguy45/events%7B/privacy%7D