108 matches found
CVE-2026-55108
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:46+00:00| published-proof-of-concept| https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x 2026-08-30 14:02:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muckkxgqnj27...
KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
GHSA-FMGP-Q6JX-GG3X KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...
EUVD-2026-67792
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
PT-2026-83236
Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.9.14 KubeVela versions 1.10.0-alpha.1 through 1.10.8 KubeVela versions 1.11.0-alpha.1 through 1.11.0-alpha.3 Description The Terraform remote configuration loader in KubeVela can be abused to cause a denial of...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: envoy-ai-gateway, ucd, crossplane-provider-aws-kinesisvideo, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-aws-dsql, crossplane-provider-aws-kendra, crossplane-provider-aws-kinesisanalytics-fips, crossplane-provider-azure-servicefabric,...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: kubevela, pulumi, rancher-machine, docker-machine-driver-harvester...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: flux-source-controller, k8sgpt, k9s, eksctl, helm-push, kubevela, cilium-cli, up, zarf, kots, chartmuseum, helm-operator, trivy, kubescape, flux-helm-controller, zot...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: flux-source-controller, k8sgpt, k9s, eksctl, helm-push, kubevela, cilium-cli, up, zarf, kots, chartmuseum, helm-operator, trivy, kubescape, flux-helm-controller, zot...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: kubernetes-fips, rancher-webhook-fips, caddy, k3s, kubevela, prometheus-adapter, up, kubernetes, kube-oidc-proxy, metrics-server-fips, rancher-webhook, buildkitd...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: rancher-machine, docker-machine-driver-harvester, kubevela, pulumi...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: ollama, mcp-grafana, cri-tools, weaviate, grafana-alloy, loki, dgraph, gitlab-runner, redpanda, terragrunt, vcluster, rclone, dagger, lazygit, maru, k8sgpt, nfpm, tempo, opentelemetry-collector, prometheus, minio, eksctl, datadog-agent, k3s, teleport, malcontent,...