VULNERABILITY INTELLIGENCE

CVE-2026-44795

CVSS score8.8 HIGH

EPSS probability1.01%

CISA KEVNot currently listed

Published2026-07-10

Last modified2026-07-21

Description

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.