« Volver al listado

CVE-2025-27616

Estado: AplazadaAlta (8.5)—

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Suplantación de webhook (spoofing) con headers específicos en servicio CI/CD accesible remotamente (AV:N, PR:L) permite transferir propiedad del repositorio y exfiltrar secretos a nivel de repo, comprometiendo credenciales de CI y manipulando configuración de builds.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUser Account ManagementNetwork SegmentationApplication Developer GuidanceActive Directory ConfigurationVulnerability Scanning

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Go-vela — VelaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27616",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27616",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-11T18:55:53.094356Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "go-vela",
          "product": "server",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.25.3"
            },
            {
              "status": "affected",
              "version": ">= 0.26.0, < 0.26.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-10T19:15:41.080",
  "references": [
    {
      "url": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/go-vela/server/releases/tag/v0.25.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/go-vela/server/releases/tag/v0.26.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "Vela es un framework de automatización de canalización (CI/CD) creado con tecnología de contenedores Linux escrito en Golang. Antes de las versiones 0.25.3 y 0.26.3, al falsificar el payload de un webhook con un conjunto específico de encabezados y datos de cuerpo, un atacante podía transferir la propiedad de un repositorio y sus secretos de nivel de repositorio a un repositorio separado. Estos secretos podrían ser exfiltrados por compilaciones de seguimiento al repositorio. Los usuarios con un repositorio habilitado con acceso a secretos de CI de nivel de repositorio en Vela son afectados por la vulnerabilidad, y cualquier usuario con acceso a la instancia de CI y al administrador de control de código fuente vinculado puede realizar la vulnerabilidad. Las versiones 0.25.3 y 0.26.3 solucionan el problema. No hay workarounds conocidos disponibles."
    }
  ],
  "lastModified": "2026-06-17T09:03:55.173",
  "sourceIdentifier": "security-advisories@github.com"
}