KubeVela up to 1.9.13/1.10.8/1.11.0-alpha.3 Terraform Remote Configuration Loader capability.go GetTerraformConfigurationFromRemote terraform.path symlink

Summaryinfo

A vulnerability, which was classified as critical, has been found in KubeVela up to 1.9.13/1.10.8/1.11.0-alpha.3. This impacts the function GetTerraformConfigurationFromRemote of the file pkg/controller/utils/capability.go of the component Terraform Remote Configuration Loader. The manipulation of the argument terraform.path leads to symlink. This vulnerability is referenced as CVE-2026-55108. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in KubeVela up to 1.9.13/1.10.8/1.11.0-alpha.3. It has been rated as critical. This issue affects the function GetTerraformConfigurationFromRemote of the file pkg/controller/utils/capability.go of the component Terraform Remote Configuration Loader. The manipulation of the argument terraform.path with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository supplied through a core.oam.dev/v1beta1 ComponentDefinition and follows repository-controlled variables.tf or main.tf symlinks. A user with permission to create or update ComponentDefinition objects can point variables.tf to /dev/zero through terraform.path, after which os.Stat and os.ReadFile follow the link and read an unbounded stream before ParseTerraformVariables or HCL parsing can reject the content. The read can exhaust memory, OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory when no effective container limit is configured. This issue is fixed in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-55108 since 06/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.9.14, 1.10.9 or 1.11.0-alpha.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• KubeVela

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.10.7
• 1.10.8
• 1.11.0-alpha.0
• 1.11.0-alpha.1
• 1.11.0-alpha.2
• 1.11.0-alpha.3

Website

• Product: https://github.com/kubevela/kubevela/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion