Skip to content
OpenAdvisories

Package · Go

github.com/go-vela/server

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.6
    CVE-2025-27616

    Vela Server has Insufficient Webhook Payload Data Verification

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a r…

    go-vela server github.com/go-vela/server Go
  • High 7.7
    GHSA-69p4-j5v5-x234

    Server/API for Vela Insecure Variable Substitution

    ### Impact Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expo…

    github.com/go-vela/server Go
  • High 7.5
    CVE-2021-21432

    Reject unauthorized access with GitHub PATs

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` fi…

    go-vela server github.com/go-vela/server Go