Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.

Workarounds Disable kustomize bakes

Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: CloudFormation deployments CloudFoundry Baking

The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.

Patches 2025.3.3, 2026.0.3 and 2025.4.4.

Workarounds Disable the CloudFormation system and cloudfoundry baking operations.

Resources Join Spinnaker on Slack for more information!

Impact Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. Unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enables a user to use arbitrary java classes which allow deep access to the system. This enables the ability to invoke commands, access files, etc.

Workarounds Disable echo entirely.

Impact A bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily.

Workarounds Disable the gitrepo artifact types.