CVE-2026-55108

Received Received - Intake

Memory Exhaustion in KubeVela via Malicious Terraform Symlink

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository supplied through a core.oam.dev/v1beta1 ComponentDefinition and follows repository-controlled variables.tf or main.tf symlinks. A user with permission to create or update ComponentDefinition objects can point variables.tf to /dev/zero through terraform.path, after which os.Stat and os.ReadFile follow the link and read an unbounded stream before ParseTerraformVariables or HCL parsing can reject the content. The read can exhaust memory, OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory when no effective container limit is configured. This issue is fixed in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55108

EUVD

EUVD-2026-67792

Affected Vendors & Products

Vendor	Product	Version / Range
kubevela	kubevela	1.9.14
kubevela	kubevela	1.10.9
kubevela	kubevela	1.11.0-alpha.4
kubevela	kubevela	From 1.10.0-alpha.1 (inc) to 1.10.9 (inc)
kubevela	kubevela	From 1.11.0-alpha.1 (exc) to 1.11.0-alpha.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in KubeVela allows an attacker with create/update permissions on ComponentDefinition to exploit a symlink in a Terraform remote schematic pointing to /dev/zero. This causes the vela-core controller to read an unbounded stream of data, leading to excessive memory consumption, OOM kills, and denial-of-service conditions.

Detection Guidance

Monitor vela-core controller logs for repeated OOM kills or high memory usage. Check for ComponentDefinition objects with suspicious remote Terraform repositories. Use Kubernetes commands like kubectl get pods -n <namespace> to inspect vela-core Pod restarts and kubectl top pod -n <namespace> to check memory consumption.

Impact Analysis

The impact includes memory exhaustion, OOM kills of the vela-core controller, repeated Pod restarts, and potential node memory pressure. If no memory limits are set, it can disrupt the entire KubeVela control plane, affecting application delivery and management.

Mitigation Strategies

Upgrade KubeVela to versions 1.9.14, 1.10.9, or 1.11.0-alpha.4 or later. Restrict permissions for creating/updating ComponentDefinition objects to trusted users. Monitor and set memory limits for vela-core Pods to prevent OOM kills.

Hi! I’m here to help you understand CVE-2026-55108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70