{"id":"CVE-2026-44795","title":"Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types","summary":"Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types","severity":"high","cvss":8.5,"cwe":["CWE-470","CWE-502"],"vendor":"spinnaker","product":"io.spinnaker.rosco:rosco-core","ecosystem":"maven","affected":["io.spinnaker.rosco:rosco-core < 2025.3.3","io.spinnaker.orca:orca-core < 2025.3.3","io.spinnaker.rosco:rosco-core >= 2025.4.0, < 2025.4.4","io.spinnaker.rosco:rosco-core >= 2026.0.0, < 2026.0.3","io.spinnaker.orca:orca-core >= 2025.4.0, < 2025.4.4","io.spinnaker.orca:orca-core >= 2026.0.0, < 2026.0.3"],"patched":["io.spinnaker.rosco:rosco-core 2025.3.3","io.spinnaker.orca:orca-core 2025.3.3","io.spinnaker.rosco:rosco-core 2025.4.4","io.spinnaker.rosco:rosco-core 2026.0.3","io.spinnaker.orca:orca-core 2025.4.4","io.spinnaker.orca:orca-core 2026.0.3"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-c8q4-9h32-2ww8","references":[{"url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-c8q4-9h32-2ww8"},{"url":"https://github.com/advisories/GHSA-c8q4-9h32-2ww8"}],"tags":["ghsa","maven"],"ingestedAt":"2026-06-29T13:24:35.508Z","epss":0.01012,"epssPercentile":0.61701,"slug":"CVE-2026-44795","body":"## Overview\n\n### Impact\nThere's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:\n* CloudFormation deployments\n* CloudFoundry Baking\n\nThe usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.\n\n### Patches\n 2025.3.3, 2026.0.3 and 2025.4.4.\n\n### Workarounds\nDisable the CloudFormation system and cloudfoundry baking operations.\n\n### Resources\nJoin Spinnaker on Slack for more information!\n\n## Affected packages\n\n- `io.spinnaker.rosco:rosco-core < 2025.3.3`\n- `io.spinnaker.orca:orca-core < 2025.3.3`\n- `io.spinnaker.rosco:rosco-core >= 2025.4.0, < 2025.4.4`\n- `io.spinnaker.rosco:rosco-core >= 2026.0.0, < 2026.0.3`\n- `io.spinnaker.orca:orca-core >= 2025.4.0, < 2025.4.4`\n- `io.spinnaker.orca:orca-core >= 2026.0.0, < 2026.0.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.spinnaker.rosco:rosco-core 2025.3.3`\n- `io.spinnaker.orca:orca-core 2025.3.3`\n- `io.spinnaker.rosco:rosco-core 2025.4.4`\n- `io.spinnaker.rosco:rosco-core 2026.0.3`\n- `io.spinnaker.orca:orca-core 2025.4.4`\n- `io.spinnaker.orca:orca-core 2026.0.3`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}