go-vela server up to 0.25.2/0.26.2 authentication spoofing

Summaryinfo

A vulnerability has been found in go-vela server up to 0.25.2/0.26.2 and classified as critical. This impacts an unknown function. The manipulation leads to authentication spoofing. This vulnerability is traded as CVE-2025-27616. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in go-vela server up to 0.25.2/0.26.2. This issue affects an unknown part. The manipulation with an unknown input leads to a authentication spoofing vulnerability. Using CWE to declare the problem leads to CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-27616 since 03/03/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.25.3 or 0.26.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 257886e5a3eea518548387885894e239668584f5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• go-vela

Name

• server

Version

• 0.25.0
• 0.25.1
• 0.25.2
• 0.26.0
• 0.26.1
• 0.26.2

License

• open-source

Website

• Product: https://github.com/go-vela/server/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion