PT-2026-51444 · Maven · Io.Spinnaker.Orca:Orca-Core+1

Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-44795

OSV

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Impact

There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:

• CloudFormation deployments
• CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

Patches

2025.3.3, 2026.0.3 and 2025.4.4.

Workarounds

Disable the CloudFormation system and cloudfoundry baking operations.

Resources

Join Spinnaker on Slack for more information!

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-470

CWE-502

Identificadores relacionados

CVE-2026-44795

GHSA-C8Q4-9H32-2WW8

Produtos afetados

Io.Spinnaker.Orca:Orca-Core

Io.Spinnaker.Rosco:Rosco-Core

Referências · 3

• https://github.com/spinnaker/spinnaker · Nota
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-c8q4-9h32-2ww8 · Nota
• https://osv.dev/vulnerability/GHSA-c8q4-9h32-2ww8 · Aviso do Fabricante