CVE - CVE-2025-27616

CVE-ID
CVE-2025-27616	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5 URL:https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5 MISC:https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b URL:https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b MISC:https://github.com/go-vela/server/releases/tag/v0.25.3 URL:https://github.com/go-vela/server/releases/tag/v0.25.3 MISC:https://github.com/go-vela/server/releases/tag/v0.26.3 URL:https://github.com/go-vela/server/releases/tag/v0.26.3 MISC:https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x URL:https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20250303	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250303)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)