RCE in Go-Vela Compiler
CVE-2020-26294
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.018 (75.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Go-vela Compiler — versions < 0.6.1
- Target Compiler
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Product, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-26294?
- CVE-2020-26294 is a high-severity vulnerability in Go-Vela Compiler, classified under OS Command Injection. CVSS score: 7.4/10. Published 2021-01-04.
- How severe is CVE-2020-26294?
- High severity. CVSS v3 base score is 7.4 out of 10.