CVE-2026-44795: Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types
(updated )
There’s an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:
- CloudFormation deployments
- CloudFoundry Baking
The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.
References
- github.com/advisories/GHSA-c8q4-9h32-2ww8
- github.com/spinnaker/spinnaker/commit/4cbe1d5fea9df573aadfd8b093fb4b594b354ee5
- github.com/spinnaker/spinnaker/commit/e57c0db4584b398473a7bbb19402ce6c1e89b627
- github.com/spinnaker/spinnaker/commit/f69d7b534d068ed74d0d3a1fbf17e2c945d36e5e
- github.com/spinnaker/spinnaker/security/advisories/GHSA-c8q4-9h32-2ww8
- nvd.nist.gov/vuln/detail/CVE-2026-44795
Code Behaviors & Features
Detect and mitigate CVE-2026-44795 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →