GHSA-p68j-q7hf-3qcp: High severity maven/io.spinnaker.rosco:rosco-manifests vulnerability
Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds Disable kustomize bakes
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.spinnaker.rosco:rosco-manifeststo a version that resolves this vulnerability.Fixed in 2026.1.1 - Upgrade
Upgrade
maven/io.spinnaker.rosco:rosco-manifeststo a version that resolves this vulnerability.Fixed in 2026.0.3 - Upgrade
Upgrade
maven/io.spinnaker.rosco:rosco-manifeststo a version that resolves this vulnerability.Fixed in 2025.4.4 - Upgrade
Upgrade
maven/io.spinnaker.rosco:rosco-manifeststo a version that resolves this vulnerability.Fixed in 2025.3.4 - Configuration
Disable kustomize bake operations and use another provider instead (this workaround is only possible when using Kustomize).
Kustomize bakes kustomize bake operations = blocked/disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure is limited to Rosco deployments that perform Kustomize bake operations. Deployments using other bake providers instead of Kustomize are not affected by this issue.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to trigger or influence a Kustomize bake operation with unsafe tag processing. The published vector also indicates network reachability, low privileges, and no user interaction requirement, although exploitation complexity is high.
What can be done if an update cannot be applied immediately?
Disable Kustomize bakes and use another provider. Blocking Kustomize operations prevents the affected unsafe tag-processing path from being used.