Insecure deserialization In io.spinnaker.rosco:rosco-core
Description
Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types
Impact
There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:
CloudFormation deployments
CloudFoundry Baking
The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.
Patches
2025.3.3, 2026.0.3 and 2025.4.4.
Workarounds
Disable the CloudFormation system and cloudfoundry baking operations.
Resources
Join Spinnaker on Slack for more information!
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2025.3.3, 2025.4.4, 2026.0.3 | ||
maven | 2025.3.3, 2025.4.4, 2026.0.3 |
Aliases
1. 2. 3. 4. 5.
References
1.