[+] CVE-2026-55175 variant analysis: KUSTOMIZE4 alternate bake endpoint [+] ROOT=/data/pruva/runs/55b9ee8a-a79a-47af-85c0-142377afebc4/bundle [+] REPO=/data/pruva/project-cache/87ef8c49-77ab-4bd0-8e6e-928652f0eb82/repo openjdk version "17.0.19" 2026-04-21 OpenJDK Runtime Environment (build 17.0.19+10-1-26.04.2-Ubuntu) OpenJDK 64-Bit Server VM (build 17.0.19+10-1-26.04.2-Ubuntu, mixed mode, sharing) javac 17.0.19 [+] Resolved vulnerable commit: d7d131a1b1fcb831256034f1e8d023f6e9dc4fc3 [+] Resolved fixed commit: f5cec213f8cf207843ed5a6929395960a1ca094f [+] Original HEAD (to restore): f5cec213f8cf207843ed5a6929395960a1ca094f [+] Checking out d7d131a1b1fcb831256034f1e8d023f6e9dc4fc3 Previous HEAD position was f5cec213f8 fix(kustomize): Add tests & fixes for kustomize behaviors (#7714) HEAD is now at d7d131a1b1 fix(echo): GitHub status conversion exception (#7701) (#7709) [+] Running KUSTOMIZE4 variant vulnerable attempt 1 on commit d7d131a1b1fcb831256034f1e8d023f6e9dc4fc3 > Task :rosco:rosco-manifests:compileGroovy NO-SOURCE > Task :rosco:rosco-manifests:classes > Task :rosco:rosco-manifests:jar > Task :rosco:rosco-web:compileJava NO-SOURCE > Task :rosco:rosco-web:compileGroovy Note: /data/pruva/project-cache/87ef8c49-77ab-4bd0-8e6e-928652f0eb82/repo/rosco/rosco-web/src/main/groovy/com/netflix/spinnaker/rosco/controllers/V2BakeryController.java uses unchecked or unsafe operations. Note: Recompile with -Xlint:unchecked for details. > Task :rosco:rosco-web:classes > Task :rosco:rosco-web:compileTestJava Note: Some input files use or override a deprecated API. Note: Recompile with -Xlint:deprecation for details. > Task :rosco:rosco-web:compileTestGroovy > Task :rosco:rosco-web:testClasses > Task :rosco:rosco-web:test Picked up JAVA_TOOL_OPTIONS: -XX:ActiveProcessorCount=2 OpenJDK 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0. You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins. See https://docs.gradle.org/7.6.1/userguide/command_line_interface.html#sec:command_line_warnings BUILD SUCCESSFUL in 47s 71 actionable tasks: 71 executed [+] Evidence from KUSTOMIZE4 vulnerable attempt 1: mode=vulnerable renderer=KUSTOMIZE4 endpoint=/api/v2/manifest/bake/KUSTOMIZE4 status=500 roscoPort=37139 payloadUrl=file:/tmp/cve-2026-55175-payload5126948354724674464/payload.jar clouddriverReached=true payloadExecuted=true unsafeTagMentioned=true body={"timestamp":"2026-07-15T13:27:33.516+00:00","status":500,"error":"Internal Server Error","exception":"java.lang.ClassCastException","message":"class javax.script.ScriptEngineManager cannot be cast to class java.lang.String (javax.script.ScriptEngineManager is in module java.scripting of loader 'platform'; java.lang.String is in module java.base of loader 'bootstrap')"} [+] KUSTOMIZE4 variant reproduced on vulnerable version: true [+] Checking out f5cec213f8cf207843ed5a6929395960a1ca094f Previous HEAD position was d7d131a1b1 fix(echo): GitHub status conversion exception (#7701) (#7709) HEAD is now at f5cec213f8 fix(kustomize): Add tests & fixes for kustomize behaviors (#7714) [+] Running KUSTOMIZE4 variant fixed attempt 1 on commit f5cec213f8cf207843ed5a6929395960a1ca094f > Task :rosco:rosco-manifests:compileGroovy NO-SOURCE > Task :rosco:rosco-manifests:classes > Task :rosco:rosco-manifests:jar > Task :rosco:rosco-web:compileJava NO-SOURCE > Task :rosco:rosco-web:compileGroovy Note: /data/pruva/project-cache/87ef8c49-77ab-4bd0-8e6e-928652f0eb82/repo/rosco/rosco-web/src/main/groovy/com/netflix/spinnaker/rosco/controllers/V2BakeryController.java uses unchecked or unsafe operations. Note: Recompile with -Xlint:unchecked for details. > Task :rosco:rosco-web:classes > Task :rosco:rosco-web:compileTestJava Note: Some input files use or override a deprecated API. Note: Recompile with -Xlint:deprecation for details. > Task :rosco:rosco-web:compileTestGroovy > Task :rosco:rosco-web:testClasses > Task :rosco:rosco-web:test Picked up JAVA_TOOL_OPTIONS: -XX:ActiveProcessorCount=2 OpenJDK 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0. You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins. See https://docs.gradle.org/7.6.1/userguide/command_line_interface.html#sec:command_line_warnings BUILD SUCCESSFUL in 42s 71 actionable tasks: 71 executed [+] Evidence from KUSTOMIZE4 fixed attempt 1: mode=fixed renderer=KUSTOMIZE4 endpoint=/api/v2/manifest/bake/KUSTOMIZE4 status=400 roscoPort=46319 payloadUrl=file:/tmp/cve-2026-55175-payload17098125514932412981/payload.jar clouddriverReached=true payloadExecuted=false unsafeTagMentioned=false body={"timestamp":"2026-07-15T13:28:16.852+00:00","status":400,"error":"Bad Request","exception":"java.lang.IllegalArgumentException","message":"Unable to find any kustomization file for root"} [+] KUSTOMIZE4 variant reproduced on fixed version (bypass): false [+] recording fixed/vulnerable version files [+] No bypass: KUSTOMIZE4 variant is covered by the existing SafeConstructor fix [+] Restoring repo to original HEAD f5cec213f8cf207843ed5a6929395960a1ca094f