Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/oam-dev/kubevela

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5GoAmendedPublished

    KubeVela Terraform remote loader DoS via unbounded file read

    CVE-2026-55108 · GHSA-fmgp-q6jx-gg3x

    Affected
    • Go github.com/oam-dev/kubevela < 1.9.14; >= 1.10.0-alpha.1, < 1.10.9; >= 1.11.0-alpha.1, < 1.11.0-alpha.4
    Fixed in
    1.11.0-alpha.41.10.91.9.14· Vendor fix available
    Issue
    KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1 ComponentDefinition registers a Terraform remote schematic that points to a malicious or compromised git repository. The repository can contain a variables.tf symlink that resolves to /dev/zero after checkout. vela-core follows the symlink and calls os.ReadFile before HCL parsing, so memory grows until the controller is OOM killed. Details The affected code is in pkg/controller/utils/capability.go, inside GetTerraformConfigurationFromRemote: https://github.com/kubevela/kubevela/blob/a24d3a9c6/pkg/controller/utils/capability.go#L231-L242 When a ComponentDefinition uses: the controller clones the user-supplied git repository and then reads variables.tf or main.tf from the checkout. The read path…

    Recommended action: Upgrade to 1.11.0-alpha.4 (pre-release), 1.10.9 or 1.9.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →
  2. Medium, CVSS 4.9GoPublished

    KubeVela VelaUX APIserver has SSRF vulnerability

    CVE-2022-39383 · GHSA-m5xf-x7q6-3rm7

    Affected
    • Go github.com/oam-dev/kubevela < 1.5.9; >= 1.6.0-alpha.1, < 1.6.2
    Fixed in
    1.5.91.6.2· Vendor fix available
    Issue
    Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: #5000 For more information If you have any questions or comments about this advisory: Open an issue in KubeVela repo Email us at here

    Recommended action: Upgrade to 1.6.2 or 1.5.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →