Loading...
Skip to main content
GeekWala

CVE-2025-27616 — Vulnerability in github.com/go-vela/server — CVE...

HIGH

Vela Server Has Insufficient Webhook Payload Data Verification

Published March 10, 2025Updated March 14, 2025Source: osv

Summary

### Impact Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit. Any user with access to the CI instance and the linked source control manager can perform the exploit. ### Method By spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. ### Patches `v0.26.3` — Image: `target/vela-server:v0.26.3` `v0.25.3` — Image: `target/vela-server:v0.25.3` ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There are no workarounds to the issue. ### References _Are there any links users can visit to find out more?_ Please see linked CWEs (common weakness enumerators) for more information.

Advisory Timeline

  • First published March 10, 2025 (581 days ago).
  • Last revised March 14, 2025 — 4 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/go-vela/server to 0.25.3 or later
go get github.com/go-vela/server@v0.25.3
Go
Update github.com/go-vela/server to 0.26.3 or later
go get github.com/go-vela/server@v0.26.3

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/go-vela/server
go
All versions0.25.3
github.com/go-vela/server
go
All versions0.26.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-27616?
Vela Server Has Insufficient Webhook Payload Data Verification This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.5/10).
How do I check if my project is affected by CVE-2025-27616?
CVE-2025-27616 affects github.com/go-vela/server. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-27616 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-9m63-33q3-xq5x
GO-2025-3509

Related CVEs

  • CVE-2022-39395
    CRITICAL

    Vela Insecure Defaults

  • CVE-2026-107809
    HIGH

    Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

  • CVE-2026-107813
    HIGH

    Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies