CyberRota Analysis
AI-GeneratedThe vulnerability affects Spinnaker, an open-source continuous delivery platform, where unsafe YAML processing allows for unsafe deserialization during CloudFormation deployments or CloudFoundry baking. This flaw enables arbitrary Java class loading, potentially leading to remote code execution. Organizations using affected versions should prioritize upgrading to the patched releases (2026.1.0, 2026.0.3, 2025.4.4, or 2025.3.3) to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.
Related CVEs
Other vulnerabilities affecting the same vendor(s)