Resource Exhaustion in KubeVela Due to Repository-Controlled Symlinks
CVE-2026-55108
What is CVE-2026-55108?
KubeVela, an open-source application delivery platform, is susceptible to a resource exhaustion vulnerability due to improper handling of repository-controlled symlinks in its Terraform remote configuration loader. Specifically, users with permissions to create or update ComponentDefinition objects can manipulate variables to point to malicious locations, resulting in reading unbounded data streams. This behavior can deplete system memory, leading to crashes and instability of the controller, making it crucial for users to upgrade to fixed versions 1.9.14, 1.10.9, or 1.11.0-alpha.4 to mitigate these risks.
Affected Version(s)
kubevela < 1.9.14 < 1.9.14
kubevela >= 1.10.0-alpha.1, < 1.10.9 < 1.10.0-alpha.1, 1.10.9
kubevela >= 1.11.0-alpha.1, < 1.11.0-alpha.4 < 1.11.0-alpha.1, 1.11.0-alpha.4