Go-vela vulnerabilities
We track 2 vulnerabilities in Go-vela products across 3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 10, 2025.
2vulnerabilities
1critical
1high
0exploited
9.2average CVSS score
Latest Go-vela vulnerabilities
- 8.5 High severity
server: Authentication Bypass by Spoofing
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a re
- 9.9 Critical severity
server: Improper Privilege Management
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and conta