Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-p68j-q7hf-3qcp
  • Maven/io.spinnaker.rosco:rosco-manifests
 Spinnaker: Improper yaml processing on kustomize bake operations 28 Aug
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-55175
  • github.com/spinnaker/spinnaker
 Spinnaker: Improper yaml processing on kustomize bake operations 10 Jul
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-44795
  • github.com/spinnaker/spinnaker
 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types 10 Jul
  • Fix available
  • Severity - 8.8 (High)
GHSA-c8q4-9h32-2ww8
  • Maven/io.spinnaker.orca:orca-core
  • Maven/io.spinnaker.rosco:rosco-core
 Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types 22 Jun
  • Fix available
  • Severity - 8.5 (High)
GHSA-69rw-45wj-g4v6
  • Maven/io.spinnaker.echo:echo-pipelinetriggers
 Spinnaker: RCE via expression parsing due to unrestricted context handling 21 Apr
  • Fix available
  • Severity - 9.9 (Critical)
GHSA-x3j7-7pgj-h87r
  • Maven/io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo
 Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths 21 Apr
  • Fix available
  • Severity - 9.9 (Critical)
CVE-2026-32613
  • github.com/spinnaker/spinnaker
 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling 20 Apr
  • Fix available
  • Severity - 9.9 (Critical)
CVE-2026-32604
  • github.com/spinnaker/spinnaker
 Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths 20 Apr
  • Fix available
  • Severity - 9.9 (Critical)
CVE-2026-25534
  • github.com/spinnaker/spinnaker
 Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames 17 Mar
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-8r8j-gfhg-fw38
  • Maven/io.spinnaker.clouddriver:clouddriver-artifacts
  • Maven/io.spinnaker.orca:orca-core
 Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames 16 Mar
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-vrjc-q2fh-6x9h
  • Maven/io.spinnaker.clouddriver:clouddriver-artifacts
 Spinnaker vulnerable to SSRF due to improper restrictions on http from user input 05 Jan
  • Fix available
  • Severity - 7.9 (High)
CVE-2025-61916
  • github.com/spinnaker/spinnaker
 Spinnaker vulnerable to SSRF due to improper restrictions on http from user input 05 Jan
  • Fix available
  • Severity - 7.9 (High)
GHSA-rq5c-hvw6-8pr7
  • Go/github.com/spinnaker/spinnaker
 Improper log output when using GitHub Status Notifications in spinnaker 29 Aug 2023
  • No fix available
  • Severity - 4.0 (Medium)
CVE-2022-23506
  • github.com/spinnaker/rosco
 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds 03 Jan 2023
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-4fcw-pq4r-f4q7
  • Maven/com.netflix.spinnaker.orca:orca-core
 Server-Side Request Forgery in Spinnaker Orca 07 May 2021
  • Fix available
  • Severity - 7.5 (High)
CVE-2020-9298
  • github.com/spinnaker/orca
 See record for full details 28 Aug 2020
  • Fix available
  • Severity - 7.5 (High)