Read the docs
TI-2020-16115 Aliases CVE-2020-26294GHSA-gv2h-gf8m-r68j

Exposure of server configuration

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78 and CWE-200.

Summary

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.

Why it matters now

EPSS 0.01798 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed compiler (go-vela): 0.6.1github.com/go-vela/compiler (Go): 0.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-velacompilerbefore 0.6.10.6.1Patch availableCNA
—github.com/go-vela/compiler (Go)before 0.6.10.6.1Patch availableGHSA-gv2h-gf8m-r68j
  • compiler Vendorgo-vela Affected before 0.6.1 Fixed in 0.6.1 Patch available CNA
  • github.com/go-vela/compiler (Go) Vendor— Affected before 0.6.1 Fixed in 0.6.1 Patch available GHSA-gv2h-gf8m-r68j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:target:compiler:*:*:*:*:*:*:*:*before 0.6.1VulnerableTarget
  • cpe:2.3:a:target:compiler:*:*:*:*:*:*:*:* Versions before 0.6.1 Vulnerable ·Target

Remediation

  • Fix · CNA compiler (go-vela) Fixed in 0.6.1
  • Fix · GHSA-gv2h-gf8m-r68j github.com/go-vela/compiler (Go) Fixed in 0.6.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26294
  2. 2026-10-03 Alias added: GHSA-gv2h-gf8m-r68j

References

Exploit 1

Patch 1

Advisory 2

Other 1

  • TI-2022-18767 Vela Insecure Defaults CVSS 3.1CRITICAL 9.9
  • TI-2025-20425 Vela Server has Insufficient Webhook Payload Data Verification CVSS 3.1HIGH 8.6
  • TI-2024-18795 Insecure Variable Substitution in Vela CVSS 3.1HIGH 7.7
  • TI-2021-04530 Reject unauthorized access with GitHub PATs CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences