CVE-2026-44795

highCVSS 8.8covered by 1 sourcefirst seen 2026-07-10

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

⚡ Watch CVE-2026-44795

Get an email if CVE-2026-44795 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-44795: Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026…nvd · 2026-07-10

External references

NVD record for CVE-2026-44795

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-44795 status](https://www.csirts.com/badge/CVE-2026-44795)](https://www.csirts.com/cve/CVE-2026-44795)