CVE-2026-44795: Spinnaker YAML Deserialization RCE Flaw

CVE-2026-44795 Overview

CVE-2026-44795 is an unsafe YAML deserialization vulnerability in Spinnaker, an open source multi-cloud continuous delivery platform. The flaw exists in code paths handling CloudFormation deployments and CloudFoundry baking, where a non-safe YAML constructor is used instead of a safe one. This allows arbitrary loading of Java classes during YAML parsing, resulting in remote code execution. The issue is classified under [CWE-470] Unsafe Reflection. Fixed versions are 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

Critical Impact
Authenticated attackers who can supply YAML input to CloudFormation or CloudFoundry pipeline stages can execute arbitrary Java code on the Spinnaker service host, compromising continuous delivery infrastructure and downstream cloud environments.

Affected Products

Spinnaker versions prior to 2026.1.0
Spinnaker versions prior to 2026.0.3
Spinnaker versions prior to 2025.4.4 and 2025.3.3

Discovery Timeline

2026-07-10 - CVE-2026-44795 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-44795

Vulnerability Analysis

Spinnaker parses YAML input in several service components, including modules that handle AWS CloudFormation templates and CloudFoundry manifest baking. The affected code path instantiates a SnakeYAML Yaml object with a default constructor rather than a SafeConstructor. The default constructor resolves YAML tags such as !!javax.script.ScriptEngineManager into Java class instantiations. An attacker who submits crafted YAML through a pipeline stage can trigger reflective loading of arbitrary classes on the classpath, leading to remote code execution in the Spinnaker service process.

Root Cause

The root cause is the use of a non-safe YAML constructor in helper code. In keel/keel-core/src/main/kotlin/com/netflix/spinnaker/keel/jackson/_yaml.kt, the function writeYamlAsJsonString invoked YamlHelper.newYaml() instead of YamlHelper.newYamlSafeConstructor(). The unsafe constructor honors YAML type tags that map directly to Java classes, bypassing the deserialization allowlist enforced by the safe variant.

Attack Vector

An attacker with pipeline authoring privileges submits a malicious YAML payload through a CloudFormation deploy stage or a CloudFoundry bake stage. The payload includes a YAML tag referencing a gadget class available on the Spinnaker classpath. When Spinnaker parses the input, the unsafe constructor instantiates the class and invokes attacker-controlled methods, achieving code execution under the service account.

kotlin

// Patch from commit 4cbe1d5fea9df573aadfd8b093fb4b594b354ee5
// File: keel/keel-core/src/main/kotlin/com/netflix/spinnaker/keel/jackson/_yaml.kt
//
// Converts a YAML stream into JSON with any anchors and aliases resolved.
//
fun ObjectMapper.writeYamlAsJsonString(stream: InputStream): String =
-  writeValueAsString(YamlHelper.newYaml().load<Map<String, Any?>>(stream))
+  writeValueAsString(YamlHelper.newYamlSafeConstructor().load<Map<String, Any?>>(stream))

// Source: https://github.com/spinnaker/spinnaker/commit/4cbe1d5fea9df573aadfd8b093fb4b594b354ee5

Detection Methods for CVE-2026-44795

Indicators of Compromise

Unexpected child processes spawned by Spinnaker microservices such as clouddriver, orca, or keel, particularly sh, bash, curl, wget, or java invocations.
Pipeline execution logs containing YAML payloads with explicit type tags such as !!javax.script.ScriptEngineManager, !!java.net.URLClassLoader, or !!com.sun.rowset.JdbcRowSetImpl.
Outbound network connections from Spinnaker service hosts to previously unseen external destinations during CloudFormation or CloudFoundry stage execution.

Detection Strategies

Scan pipeline definitions and stored YAML artifacts for SnakeYAML global type tags (!! prefixes referencing Java classes) that have no legitimate business use.
Monitor Spinnaker JVM processes for reflective class loading events and JNDI lookups originating from YAML parsing stack frames.
Correlate pipeline stage identifiers with process creation and network telemetry to identify anomalous behavior tied to CloudFormation or CloudFoundry stages.

Monitoring Recommendations

Enable verbose audit logging on Spinnaker services and forward logs to a centralized SIEM for retention and analysis.
Track file integrity for Spinnaker configuration directories and the deployed JAR set to detect tampering.
Alert on any deviation from baseline outbound traffic profiles for Spinnaker service accounts and container workloads.

How to Mitigate CVE-2026-44795

Immediate Actions Required

Upgrade Spinnaker to 2026.1.0, 2026.0.3, 2025.4.4, or 2025.3.3 depending on the deployed release branch.
Restrict pipeline authoring permissions to trusted operators and enforce code review on all pipeline template changes.
Rotate credentials and cloud provider access tokens accessible from Spinnaker service accounts if compromise is suspected.

Patch Information

The fix replaces default SnakeYAML constructors with safe constructors that reject arbitrary Java type instantiation. The patch is applied in the GitHub commit 4cbe1d5, commit e57c0db, and commit f69d7b5. Full details are available in the Spinnaker GHSA-c8q4-9h32-2ww8 advisory.

Workarounds

Disable CloudFormation deployment stages and CloudFoundry baking pipelines until the upgrade is applied.
Place Spinnaker services behind network egress controls that block outbound traffic to non-approved destinations, limiting post-exploitation options.
Run Spinnaker microservices under least-privilege service accounts with no standing administrative access to cloud provider APIs.

bash

# Verify the running Spinnaker version and upgrade using Halyard
hal version
hal config version edit --version 2026.1.0
hal deploy apply

# Confirm fixed version after deployment
kubectl -n spinnaker get pods -o jsonpath='{.items[*].spec.containers[*].image}'