CVE-2026-44795High· 8.5▾ TwilightSpinnaker has uon-safe yaml deserialization, allowing RCE when using specific types
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
0.5% → 1.0%
There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:
The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.
2025.3.3, 2026.0.3 and 2025.4.4.
Disable the CloudFormation system and cloudfoundry baking operations.
Join Spinnaker on Slack for more information!
io.spinnaker.rosco:rosco-core < 2025.3.3io.spinnaker.orca:orca-core < 2025.3.3io.spinnaker.rosco:rosco-core >= 2025.4.0, < 2025.4.4io.spinnaker.rosco:rosco-core >= 2026.0.0, < 2026.0.3io.spinnaker.orca:orca-core >= 2025.4.0, < 2025.4.4io.spinnaker.orca:orca-core >= 2026.0.0, < 2026.0.3Upgrade to a patched release:
io.spinnaker.rosco:rosco-core 2025.3.3io.spinnaker.orca:orca-core 2025.3.3io.spinnaker.rosco:rosco-core 2025.4.4io.spinnaker.rosco:rosco-core 2026.0.3io.spinnaker.orca:orca-core 2025.4.4io.spinnaker.orca:orca-core 2026.0.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19032Medium· 5.3jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme
CVE-2026-63337High· 8.8The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
CVE-2026-42027Critical· 9.8Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loa…
CVE-2026-106558High· 8.8Backstage is an open framework for building developer portals
CVE-2017-20285Critical· 9.1YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names
CVE-2026-100308High· 7.8Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a craf…