108 matches found
CVE-2026-55108
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:46+00:00| published-proof-of-concept| https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x 2026-08-30 14:02:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muckkxgqnj27...
KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
GHSA-FMGP-Q6JX-GG3X KubeVela Terraform remote loader DoS via unbounded file read
Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
CVE-2026-55108
KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...
EUVD-2026-67792
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...
PT-2026-83236
Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.9.14 KubeVela versions 1.10.0-alpha.1 through 1.10.8 KubeVela versions 1.11.0-alpha.1 through 1.11.0-alpha.3 Description The Terraform remote configuration loader in KubeVela can be abused to cause a denial of...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, flagger-fips, gotenberg, crossplane-provider-aws-cognitoidp-fips, agentbeat-fips, crossplane-provider-aws-transcribe, crossplane-provider-aws-codestarnotifications-fips, blob-csi-fips, cluster-api-gcp-controller-fips, cluster-api-fips,...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: docker-machine-driver-harvester, kubevela, pulumi, rancher-machine...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: kots, k8sgpt, k9s, kubescape, flux-helm-controller, zot, helm-operator, chartmuseum, helm-push, eksctl, cilium-cli, trivy, flux-source-controller, zarf, kubevela, up...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: kots, k8sgpt, k9s, kubescape, flux-helm-controller, zot, helm-operator, chartmuseum, helm-push, eksctl, cilium-cli, trivy, flux-source-controller, zarf, kubevela, up...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: kube-oidc-proxy, up, kubernetes, kubernetes-fips, caddy, k3s, rancher-webhook-fips, prometheus-adapter, rancher-webhook, buildkitd, kubevela, metrics-server-fips...
GO-2022-1071 vulnerabilities
Vulnerabilities for packages: kubevela...
GO-2024-3304 vulnerabilities
Vulnerabilities for packages: docker-machine-driver-harvester, pulumi, kubevela, rancher-machine...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: dagger, opentelemetry-collector-contrib, minio, redpanda, maru, k3s, gitlab-runner, teleport, tempo, malcontent, ollama, goreleaser, prometheus, terraform-mcp-server, mcp-grafana, k8sgpt, weaviate, kubevela, loki, grafana, dgraph, nfpm, cri-tools, rclone, terragrunt,...