Spinnaker Security Advisory: Unsafe YAML Processing in Kustomize Bake Operations

The Spinnaker project has issued a high-severity security advisory, published on August 28, 2026, regarding improper YAML processing during kustomize bake operations. According to the GitHub Security Advisory database, this vulnerability can lead to remote code execution (RCE) exploits on rosco pods when using kustomize bakes. The issue is specific to kustomize and does not affect other bake providers. The recommended workaround is to disable kustomize bake operations entirely and opt for an alternative provider.

Operators should carefully review their deployment pipelines to identify any reliance on kustomize bake operations. Disabling kustomize without replacing it with an alternative bake provider could disrupt automated workflows. Additionally, operators should validate whether rosco pods are exposed to external networks, as this could increase the risk of exploitation. This advisory highlights the importance of scrutinizing YAML processing mechanisms, a recurring theme in security issues across cloud-native projects.