{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/kubevela/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kubevela:vela-core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-55108"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vela-core (\u003c 1.9.14)","vela-core (\u003e= 1.10.0-alpha.1, \u003c 1.10.9)","vela-core (\u003e= 1.11.0-alpha.1, \u003c 1.11.0-alpha.4)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","kubernetes","kubevela"],"_cs_type":"advisory","_cs_vendors":["KubeVela"],"content_html":"\u003cp\u003eKubeVela versions 1.9.14, 1.10.9, and 1.11.0-alpha.4 are vulnerable to a denial-of-service (DoS) condition (CVE-2026-55108) within the \u003ccode\u003evela-core\u003c/code\u003e controller. The vulnerability exists in the Terraform remote configuration loader, specifically within \u003ccode\u003epkg/controller/utils/capability.go\u003c/code\u003e. The controller improperly validates file paths when processing remote git repositories defined in \u003ccode\u003eComponentDefinition\u003c/code\u003e resources. By crafting a repository that includes a symlink (e.g., \u003ccode\u003evariables.tf\u003c/code\u003e pointing to \u003ccode\u003e/dev/zero\u003c/code\u003e), an attacker can force the \u003ccode\u003evela-core\u003c/code\u003e controller to perform an unbounded read via \u003ccode\u003eos.ReadFile\u003c/code\u003e. Because the controller follows symlinks and does not verify file size or target location before reading, the process memory usage grows until the controller is terminated by the kernel OOM killer. This vulnerability affects the core control plane and can cause persistent crash loops if the malicious definition remains in the cluster.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains authorization to create or update \u003ccode\u003ecore.oam.dev/v1beta1\u003c/code\u003e \u003ccode\u003eComponentDefinition\u003c/code\u003e resources in a target namespace.\u003c/li\u003e\n\u003cli\u003eAttacker initializes a git repository and creates a relative symbolic link named \u003ccode\u003evariables.tf\u003c/code\u003e or \u003ccode\u003emain.tf\u003c/code\u003e that resolves to \u003ccode\u003e/dev/zero\u003c/code\u003e (e.g., \u003ccode\u003eln -s ../../../../../../dev/zero variables.tf\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker pushes the repository to a location accessible by the KubeVela controller.\u003c/li\u003e\n\u003cli\u003eAttacker creates or updates a \u003ccode\u003eComponentDefinition\u003c/code\u003e resource, setting \u003ccode\u003espec.schematic.terraform.type\u003c/code\u003e to \u003ccode\u003eremote\u003c/code\u003e and providing the URL to the malicious repository.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evela-core\u003c/code\u003e controller initiates a reconcile loop and clones the repository into its local cache.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eGetTerraformConfigurationFromRemote\u003c/code\u003e function executes \u003ccode\u003eos.Stat\u003c/code\u003e and \u003ccode\u003eos.ReadFile\u003c/code\u003e on the attacker-controlled symlink path.\u003c/li\u003e\n\u003cli\u003eThe controller consumes system memory indefinitely while reading from the \u003ccode\u003e/dev/zero\u003c/code\u003e stream.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evela-core\u003c/code\u003e controller process reaches the container memory limit and is terminated with an OOMKilled status, resulting in a denial-of-service for the KubeVela control plane.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial-of-service of the KubeVela control plane. The \u003ccode\u003evela-core\u003c/code\u003e controller Pod enters a \u003ccode\u003eCrashLoopBackOff\u003c/code\u003e state, preventing the orchestration of application components across the cluster. If the controller lacks enforced memory limits, the unbounded read can place extreme pressure on node memory, potentially impacting other co-located workloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003evela-core\u003c/code\u003e to the patched versions immediately: 1.9.14, 1.10.9, or 1.11.0-alpha.4.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003eComponentDefinition\u003c/code\u003e resources to identify and restrict \u003ccode\u003eremote\u003c/code\u003e Terraform repository URLs to trusted, internal-only sources.\u003c/li\u003e\n\u003cli\u003eImplement strict RBAC controls to limit which users can create or modify \u003ccode\u003eComponentDefinition\u003c/code\u003e objects within the cluster.\u003c/li\u003e\n\u003cli\u003eEnsure Kubernetes memory limits are configured for the \u003ccode\u003evela-core\u003c/code\u003e controller deployment to contain the impact of OOM conditions and prevent node-wide instability.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-28T21:19:20Z","date_published":"2026-08-28T21:19:20Z","id":"https://feed.craftedsignal.io/briefs/2026-08-kubevela-dos/","summary":"An attacker with ComponentDefinition management permissions can trigger a control-plane denial of service in KubeVela by injecting a symlink to /dev/zero within a remote Terraform repository, causing an OOM-induced controller crash.","title":"KubeVela Terraform Remote Loader Denial of Service via Unbounded File Read","url":"https://feed.craftedsignal.io/briefs/2026-08-kubevela-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - KubeVela","version":"https://jsonfeed.org/version/1.1"}