Skip to content
OpenAdvisories

Vendor

go-vela

5 known vulnerabilities.

Products

server 3 compiler 1 worker 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2025-27616

    Vela Server has Insufficient Webhook Payload Data Verification

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a r…

    go-vela server github.com/go-vela/server Go
  • High 7.7
    CVE-2024-28236

    Insecure Variable Substitution in Vela

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/im…

    go-vela worker github.com/go-vela/worker Go
  • High 7.5
    CVE-2021-21432

    Reject unauthorized access with GitHub PATs

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` fi…

    go-vela server github.com/go-vela/server Go
  • High 7.4
    CVE-2020-26294

    Exposure of server configuration

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can …

    go-vela compiler github.com/go-vela/compiler Go