What is GHSA-c8q4-9h32-2ww8?

GHSA-c8q4-9h32-2ww8 is a security advisory published by GitHub Security Advisories with High severity. Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types

Which CVE IDs does GHSA-c8q4-9h32-2ww8 cover?

GHSA-c8q4-9h32-2ww8 covers the following CVE IDs: CVE-2026-44795. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c8q4-9h32-2ww8?

GHSA-c8q4-9h32-2ww8 has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c8q4-9h32-2ww8?

GHSA-c8q4-9h32-2ww8 affects 6 products, including: maven/io.spinnaker.rosco:rosco-core:\u003c 2025.3.3; maven/io.spinnaker.orca:orca-core:\u003c 2025.3.3; maven/io.spinnaker.rosco:rosco-core:\u003e= 2025.4.0, \u003c 2025.4.4; maven/io.spinnaker.rosco:rosco-core:\u003e= 2026.0.0, \u003c 2026.0.3; maven/io.spinnaker.orca:orca-core:\u003e= 2025.4.0, \u003c 2025.4.4; and others — see the full list on the advisory page.

GHSA-c8q4-9h32-2ww8HighCVSS 8.5

Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types

Vendor

GitHub Security Advisories

Published

June 22, 2026

Last Modified

June 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-44795 →

📋 Description

Impact

There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:

CloudFormation deployments
CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

Patches

2025.3.3, 2026.0.3 and 2025.4.4.

Workarounds

Disable the CloudFormation system and cloudfoundry baking operations.

Resources

Join Spinnaker on Slack for more information!

🎯 Affected products6

maven/io.spinnaker.rosco:rosco-core:< 2025.3.3
maven/io.spinnaker.orca:orca-core:< 2025.3.3
maven/io.spinnaker.rosco:rosco-core:>= 2025.4.0, < 2025.4.4
maven/io.spinnaker.rosco:rosco-core:>= 2026.0.0, < 2026.0.3
maven/io.spinnaker.orca:orca-core:>= 2025.4.0, < 2025.4.4
maven/io.spinnaker.orca:orca-core:>= 2026.0.0, < 2026.0.3