Skip to content
OpenAdvisories

Product · go-vela

server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2025-27616

    Vela Server has Insufficient Webhook Payload Data Verification

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a r…

    go-vela server github.com/go-vela/server Go
  • High 7.5
    CVE-2021-21432

    Reject unauthorized access with GitHub PATs

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` fi…

    go-vela server github.com/go-vela/server Go