PT-2025-10628 · Vela · Vela

Ecrupper · Published 2025-03-10 · Updated 2025-03-15 · CVE-2025-27616

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vela versions prior to 0.25.3 Vela versions prior to 0.26.3

Description The issue allows an attacker to transfer ownership of a repository and its secrets to a separate repository by spoofing a webhook payload with specific headers and body data. This could lead to the exfiltration of secrets through follow-up builds. Users with access to repository-level CI secrets and the CI instance are vulnerable.

Recommendations For versions prior to 0.25.3, update to version 0.25.3 or later to resolve the issue. For versions prior to 0.26.3, update to version 0.26.3 or later to resolve the issue.

Exploit

Fix

Insufficient Verification of Data Authenticity

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-345

CWE-290

Related Identifiers

CVE-2025-27616

GHSA-9M63-33Q3-XQ5X

GO-2025-3509

OPENSUSE-SU-2025:14893-1

Affected Products

Vela

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27616.json · Exploit
• https://osv.dev/vulnerability/GHSA-9m63-33q3-xq5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27616 · Security Note
• https://osv.dev/vulnerability/GO-2025-3509 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27616 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14893-1 · Vendor Advisory
• https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x · Note
• https://github.com/go-vela/server/releases/tag/v0.25.3 · Note
• https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b · Note
• https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5 · Note
• https://github.com/go-vela/server/releases/tag/v0.26.3 · Note
• https://github.com/go-vela/server · Note
• https://twitter.com/CveFindCom/status/1899173952406110688 · Twitter Post
• https://suse.com/security/cve/CVE-2024-52812 · Note
• https://t.me/cvedetector/19990 · Telegram Post