107 matches found
CVE-2026-55108
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:46+00:00| published-proof-of-concept| https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x 2026-08-30 14:02:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muckkxgqnj27...
KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
GHSA-FMGP-Q6JX-GG3X KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...
EUVD-2026-67792
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
PT-2026-83236
Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.9.14 KubeVela versions 1.10.0-alpha.1 through 1.10.8 KubeVela versions 1.11.0-alpha.1 through 1.11.0-alpha.3 Description The Terraform remote configuration loader in KubeVela can be abused to cause a denial of...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: json-exporter, terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, pulumi-language-java, chronyexporter, crossplane-provider-aws-cloudcontrol-fips, crossplane-provider-aws-memorydb-fips, crossplane-provider-aws-configservice-fips,...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: pulumi, docker-machine-driver-harvester, rancher-machine, kubevela...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: zarf, helm-push, trivy, zot, flux-helm-controller, k8sgpt, flux-source-controller, chartmuseum, helm-operator, k9s, kots, up, cilium-cli, eksctl, kubevela, kubescape...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: zarf, helm-push, trivy, zot, flux-helm-controller, k8sgpt, flux-source-controller, chartmuseum, helm-operator, k9s, kots, up, cilium-cli, eksctl, kubevela, kubescape...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: buildkitd, k3s, rancher-webhook, kubernetes, kube-oidc-proxy, rancher-webhook-fips, up, metrics-server-fips, caddy, kubernetes-fips, prometheus-adapter, kubevela...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: rancher-machine, docker-machine-driver-harvester, kubevela, pulumi...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: mcp-grafana, gitlab-runner, datadog-agent, k3s, nuclei, dgraph, terraform-mcp-server, teleport, goreleaser, tempo, grafana-alloy, dagger, minio, cri-tools, k8sgpt, eksctl, ollama, kubevela, vcluster, grafana, redpanda, loki, opentelemetry-collector, weaviate,...