CVE-2021-21432: Unauthorized Access Vulnerability in github.com/go-vela/server
Summary
CVE-2021-21432: Reject unauthorized access with GitHub PATs. Affects github.com/go-vela/server versions >= 0.7.0, < 0.7.5. Fixed in 0.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/go-vela/server package is a Go-based server implementation for Vela, a continuous integration and deployment platform. It provides functionality for managing user authentication, repository activation, and secret management. This package is vulnerable to unauthorized access, allowing malicious users to obtain secrets by exploiting injected credentials in the ~/.netrc file.
Vulnerability Detail
The vulnerability allows an attacker to gain unauthorized access to secrets stored in the ~/.netrc file. By promoting themselves to a Vela administrator, the attacker can activate a repository and add a malicious .vela.yml file that executes a command to read the contents of the ~/.netrc file. This file may contain credentials, such as a GitHub Personal Access Token (PAT), which can be used to access sensitive resources. The attacker can then use this token to perform unauthorized actions on the activated repository or any other API endpoints accessible to the user.
How To Fix
Latest published version: v0.28.10 as of 23 Oct 2026
go get github.com/go-vela/server@v0.28.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.5
This is the first release that contains the fix.
go get github.com/go-vela/server@v0.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The unauthorized access vulnerability in the github.com/go-vela/server package allows attackers to obtain sensitive credentials and perform unauthorized actions on affected GitHub repositories. Users should upgrade to version v0.7.5 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/go-vela/server →
FAQ
The vulnerability allows an attacker to obtain sensitive credentials, such as GitHub Personal Access Tokens, which can be used to access and manipulate resources on the affected GitHub repositories.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known public exploits for this vulnerability at the time of this report. However, it is recommended to upgrade to the patched version to mitigate the risk.
No, the only way to mitigate the risk is to upgrade to version v0.7.5 or later of the github.com/go-vela/server package.
You can find more information about this vulnerability in the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8j3f-mhq8-gmh4/GHSA-8j3f-mhq8-gmh4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-vela/server.
