CVE-2025-27616

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27616", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-03-03T15:10:34.080Z", "datePublished": "2025-03-10T18:56:14.537Z", "dateUpdated": "2025-03-11T18:56:11.199Z"}, "containers": {"cna": {"title": "Vela Server has Insufficient Webhook Payload Data Verification", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x"}, {"name": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5"}, {"name": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b"}, {"name": "https://github.com/go-vela/server/releases/tag/v0.25.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-vela/server/releases/tag/v0.25.3"}, {"name": "https://github.com/go-vela/server/releases/tag/v0.26.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-vela/server/releases/tag/v0.26.3"}], "affected": [{"vendor": "go-vela", "product": "server", "versions": [{"version": "< 0.25.3", "status": "affected"}, {"version": ">= 0.26.0, < 0.26.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-03-10T18:56:14.537Z"}, "descriptions": [{"lang": "en", "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available."}], "source": {"advisory": "GHSA-9m63-33q3-xq5x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-11T18:55:53.094356Z", "id": "CVE-2025-27616", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T18:56:11.199Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-11T18:55:53.094356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T18:56:04.065Z"}}], "cna": {"title": "Vela Server has Insufficient Webhook Payload Data Verification", "source": {"advisory": "GHSA-9m63-33q3-xq5x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "go-vela", "product": "server", "versions": [{"status": "affected", "version": "< 0.25.3"}, {"status": "affected", "version": ">= 0.26.0, < 0.26.3"}]}], "references": [{"url": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x", "name": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5", "name": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b", "name": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/go-vela/server/releases/tag/v0.25.3", "name": "https://github.com/go-vela/server/releases/tag/v0.25.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/go-vela/server/releases/tag/v0.26.3", "name": "https://github.com/go-vela/server/releases/tag/v0.26.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-03-10T18:56:14.537Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27616", "state": "PUBLISHED", "dateUpdated": "2025-03-11T18:56:11.199Z", "dateReserved": "2025-03-03T15:10:34.080Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-03-10T18:56:14.537Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "server", "vendor": "go-vela", "versions": [{"status": "affected", "version": "< 0.25.3"}, {"status": "affected", "version": ">= 0.26.0, < 0.26.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available."}, {"lang": "es", "value": "Vela es un framework de automatizaci\u00f3n de canalizaci\u00f3n (CI/CD) creado con tecnolog\u00eda de contenedores Linux escrito en Golang. Antes de las versiones 0.25.3 y 0.26.3, al falsificar el payload de un webhook con un conjunto espec\u00edfico de encabezados y datos de cuerpo, un atacante pod\u00eda transferir la propiedad de un repositorio y sus secretos de nivel de repositorio a un repositorio separado. Estos secretos podr\u00edan ser exfiltrados por compilaciones de seguimiento al repositorio. Los usuarios con un repositorio habilitado con acceso a secretos de CI de nivel de repositorio en Vela son afectados por la vulnerabilidad, y cualquier usuario con acceso a la instancia de CI y al administrador de control de c\u00f3digo fuente vinculado puede realizar la vulnerabilidad. Las versiones 0.25.3 y 0.26.3 solucionan el problema. No hay workarounds conocidos disponibles."}], "id": "CVE-2025-27616", "lastModified": "2026-06-17T09:03:55.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27616", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-11T18:55:53.094356Z", "version": "2.0.3"}}]}, "published": "2025-03-10T19:15:41.080", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-vela/server/releases/tag/v0.25.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-vela/server/releases/tag/v0.26.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-13T11:07:01.703778+00:00", "updated": "2025-07-13T11:07:01.703851+00:00", "vendors": ["go-vela", "go-vela$PRODUCT$server"]}