Most recent entries from all

EUVD-2026-361459

2026-10-08T04:18:28.778703+00:00

EUVD-2026-361459

fkie_cve-2026-55108

2026-10-08T04:18:28.778748+00:00

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository supplied through a core.oam.dev/v1beta1 ComponentDefinition and follows repository-controlled variables.tf or main.tf symlinks. A user with permission to create or update ComponentDefinition objects can point variables.tf to /dev/zero through terraform.path, after which os.Stat and os.ReadFile follow the link and read an unbounded stream before ParseTerraformVariables or HCL parsing can reject the content. The read can exhaust memory, OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory when no effective container limit is configured. This issue is fixed in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.

GHSA-fmgp-q6jx-gg3x — KubeVela Terraform remote loader DoS via unbounded file read

2026-10-08T04:18:28.778788+00:00

Affected: Go: github.com/oam-dev/kubevela

### Summary

KubeVela's Terraform remote configuration loader can be abused to make `vela-core` read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service.

The issue is reachable when a user with permission to create or update a `core.oam.dev/v1beta1` `ComponentDefinition` registers a Terraform `remote` schematic that points to a malicious or compromised git repository. The repository can contain a `variables.tf` symlink that resolves to `/dev/zero` after checkout. `vela-core` follows the symlink and calls `os.ReadFile` before HCL parsing, so memory grows until the controller is OOM killed.

### Details

The affected code is in `pkg/controller/utils/capability.go`, inside `GetTerraformConfigurationFromRemote`:

https://github.com/kubevela/kubevela/blob/a24d3a9c6/pkg/controller/utils/capability.go#L231-L242

```go tfPath := filepath.Join(cachePath, remotePath, "variables.tf") if _, err := os.Stat(tfPath); err != nil { tfPath = filepath.Join(cachePath, remotePath, "main.tf") if _, err := os.Stat(tfPath); err != nil { return "", errors.Wrap(err, "failed to find main.tf or variables.tf in Terraform configurations of the remote repository") } } conf, err := os.ReadFile(filepath.Clean(tfPath)) if err != nil { return "", errors.Wrap(err, "failed to read Terraform configuration") } ```

When a `ComponentDefinition` uses:

```yaml schematic: terraform: type: remote configuration: