---
id: CVE-2026-44795
title: >-
  Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific
  types
summary: >-
  Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific
  types
severity: high
cvss: 8.5
cwe:
  - CWE-470
  - CWE-502
vendor: spinnaker
product: 'io.spinnaker.rosco:rosco-core'
ecosystem: maven
affected:
  - 'io.spinnaker.rosco:rosco-core < 2025.3.3'
  - 'io.spinnaker.orca:orca-core < 2025.3.3'
  - 'io.spinnaker.rosco:rosco-core >= 2025.4.0, < 2025.4.4'
  - 'io.spinnaker.rosco:rosco-core >= 2026.0.0, < 2026.0.3'
  - 'io.spinnaker.orca:orca-core >= 2025.4.0, < 2025.4.4'
  - 'io.spinnaker.orca:orca-core >= 2026.0.0, < 2026.0.3'
patched:
  - 'io.spinnaker.rosco:rosco-core 2025.3.3'
  - 'io.spinnaker.orca:orca-core 2025.3.3'
  - 'io.spinnaker.rosco:rosco-core 2025.4.4'
  - 'io.spinnaker.rosco:rosco-core 2026.0.3'
  - 'io.spinnaker.orca:orca-core 2025.4.4'
  - 'io.spinnaker.orca:orca-core 2026.0.3'
published: '2026-06-22'
updated: '2026-06-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-c8q4-9h32-2ww8'
references:
  - url: >-
      https://github.com/spinnaker/spinnaker/security/advisories/GHSA-c8q4-9h32-2ww8
  - url: 'https://github.com/advisories/GHSA-c8q4-9h32-2ww8'
tags:
  - ghsa
  - maven
ingestedAt: '2026-06-29T13:24:35.508Z'
epss: 0.01012
epssPercentile: 0.61614
---

## Overview

### Impact
There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:
* CloudFormation deployments
* CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

### Patches
 2025.3.3, 2026.0.3 and 2025.4.4.

### Workarounds
Disable the CloudFormation system and cloudfoundry baking operations.

### Resources
Join Spinnaker on Slack for more information!

## Affected packages

- `io.spinnaker.rosco:rosco-core < 2025.3.3`
- `io.spinnaker.orca:orca-core < 2025.3.3`
- `io.spinnaker.rosco:rosco-core >= 2025.4.0, < 2025.4.4`
- `io.spinnaker.rosco:rosco-core >= 2026.0.0, < 2026.0.3`
- `io.spinnaker.orca:orca-core >= 2025.4.0, < 2025.4.4`
- `io.spinnaker.orca:orca-core >= 2026.0.0, < 2026.0.3`

## Remediation

Upgrade to a patched release:

- `io.spinnaker.rosco:rosco-core 2025.3.3`
- `io.spinnaker.orca:orca-core 2025.3.3`
- `io.spinnaker.rosco:rosco-core 2025.4.4`
- `io.spinnaker.rosco:rosco-core 2026.0.3`
- `io.spinnaker.orca:orca-core 2025.4.4`
- `io.spinnaker.orca:orca-core 2026.0.3`