CVE-2026-55108
unknown
CVSS v3
—
CVSS v4 NEW
—
VIR risk
—
Description
KubeVela Terraform remote loader DoS via unbounded file read
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/oam-dev/kubevela | <1.9.14 | 1.9.14 |
| Go | github.com/oam-dev/kubevela | >=1.10.0-alpha.1,<1.10.9 | 1.10.9 |
| Go | github.com/oam-dev/kubevela | >=1.11.0-alpha.1,<1.11.0-alpha.4 | 1.11.0-alpha.4 |
References
- https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x
- https://github.com/kubevela/kubevela/pull/7191
- https://github.com/kubevela/kubevela/pull/7192
- https://github.com/kubevela/kubevela/commit/65dedda40a69cc1eccf4072a4c835e5b9f13334e
- https://github.com/kubevela/kubevela/commit/7a4e59b2958ce1cf031fafbc188d6fafe8fe4d2e
- https://github.com/kubevela/kubevela/commit/f6a64398b5e0065c57c3a0fb6765dd3dc48c749d
- https://github.com/kubevela/kubevela
- https://github.com/kubevela/kubevela/releases/tag/v1.10.9
- https://github.com/kubevela/kubevela/releases/tag/v1.11.0-alpha.4
- https://github.com/kubevela/kubevela/releases/tag/v1.9.14
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.