CyberSecBulletin

Kubevela vulnerabilities

We track 2 vulnerabilities in Kubevela products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.

2vulnerabilities
1critical
1high
0exploited
9.2average CVSS score

Latest Kubevela vulnerabilities

  • 8.5 High severity

    kubevela: Improper Link Resolution Before File Access

    CVE-2026-55108Kubevela

    KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfiguratio

  • 9.8 Critical severity

    kubevela: Authentication Bypass by Capture-replay

    CVE-2022-36089Kubevela

    KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to genera