107 matches found
CVE-2026-55108
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:46+00:00| published-proof-of-concept| https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x 2026-08-30 14:02:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muckkxgqnj27...
KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
GHSA-FMGP-Q6JX-GG3X KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...
EUVD-2026-67792
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
PT-2026-83236
Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.9.14 KubeVela versions 1.10.0-alpha.1 through 1.10.8 KubeVela versions 1.11.0-alpha.1 through 1.11.0-alpha.3 Description The Terraform remote configuration loader in KubeVela can be abused to cause a denial of...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, crossplane-provider-aws-cognitoidentity, jobset-fips, authentik, kubernetes-dashboard-api-fips, crossplane-provider-aws-macie2, crossplane-provider-gcp-beta-networksecurity, k9s, envoy-gateway-fips, k8s-image-swapper,...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: kubevela, rancher-machine, pulumi, docker-machine-driver-harvester...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: kubevela, flux-source-controller, kubescape, helm-push, k9s, zot, zarf, trivy, chartmuseum, kots, flux-helm-controller, up, k8sgpt, cilium-cli, helm-operator, eksctl...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: kubevela, flux-source-controller, kubescape, helm-push, k9s, zot, zarf, trivy, chartmuseum, kots, flux-helm-controller, up, k8sgpt, cilium-cli, helm-operator, eksctl...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: kubevela, kubernetes-fips, rancher-webhook, rancher-webhook-fips, kube-oidc-proxy, up, prometheus-adapter, k3s, caddy, buildkitd, metrics-server-fips, kubernetes...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: rancher-machine, docker-machine-driver-harvester, pulumi, kubevela...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: nfpm, loki, minio, grafana-alloy, teleport, weaviate, eksctl, prometheus, terragrunt, redpanda, datadog-agent, witness, malcontent, kubevela, maru, mcp-grafana, goreleaser, gitlab-runner, cri-tools, grafana, opentelemetry-collector-contrib, opentelemetry-collector,...