Vela Server has Insufficient Webhook Payload Data Verification
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-vela | server | before 0.25.3; 0.26.0 to before 0.26.3 | 0.25.3, 0.26.3 | Patch available | CNA |
| — | github.com/go-vela/server (Go) | before 0.25.3 | 0.25.3 | Patch available | GHSA-9m63-33q3-xq5x |
| — | github.com/go-vela/server (Go) | 0.26.0 to before 0.26.3 | 0.26.3 | Patch available | GHSA-9m63-33q3-xq5x |
- server Vendorgo-vela Affected before 0.25.3; 0.26.0 to before 0.26.3 Fixed in 0.25.3, 0.26.3 Patch available CNA
- github.com/go-vela/server (Go) Vendor— Affected before 0.25.3 Fixed in 0.25.3 Patch available GHSA-9m63-33q3-xq5x
- github.com/go-vela/server (Go) Vendor— Affected 0.26.0 to before 0.26.3 Fixed in 0.26.3 Patch available GHSA-9m63-33q3-xq5x
Remediation
- Fix · CNA server (go-vela) Fixed in 0.25.3, 0.26.3
- Fix · GHSA-9m63-33q3-xq5x github.com/go-vela/server (Go) Fixed in 0.25.3 Advisory →
- Fix · GHSA-9m63-33q3-xq5x github.com/go-vela/server (Go) Fixed in 0.26.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27616
- 2026-10-03 Alias added: GHSA-9m63-33q3-xq5x
References
Other 7
- https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x
- https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5
- https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b
- https://github.com/go-vela/server/releases/tag/v0.25.3
- https://github.com/go-vela/server/releases/tag/v0.26.3
- https://github.com/go-vela/server
- https://pkg.go.dev/vuln/GO-2025-3509
More go-vela vulnerabilities
- TI-2022-18767 Vela Insecure Defaults CVSS 3.1CRITICAL 9.9
- TI-2020-16115 Exposure of server configuration CVSS 3.1HIGH 7.4
- TI-2024-18795 Insecure Variable Substitution in Vela CVSS 3.1HIGH 7.7
- TI-2021-04530 Reject unauthorized access with GitHub PATs CVSS 3.1HIGH 7.5
Sources
- CVE-2025-27616 · CVE Program
- CVE-2025-27616 · NVD
- FIRST EPSS
- GHSA-9m63-33q3-xq5x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences