Skip to content
OpenAdvisories

Package · Go

github.com/go-vela/server

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.6
    CVE-2025-27616

    Vela Server has Insufficient Webhook Payload Data Verification

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a r…

    go-vela server github.com/go-vela/server Go
  • High 7.7
    GHSA-69p4-j5v5-x234

    Server/API for Vela Insecure Variable Substitution

    ### Impact Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expo…

    github.com/go-vela/server Go
  • Critical 9.6
    CVE-2022-39395

    Vela Insecure Defaults

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and cont…

    go-vela server github.com/go-vela/server github.com/go-vela/worker Go
  • High 7.5
    CVE-2021-21432

    Reject unauthorized access with GitHub PATs

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` fi…

    go-vela server github.com/go-vela/server Go