CVE-2022-39395: Vela Insecure Defaults in github.com/go-vela/server
Summary
CVE-2022-39395: Vela Insecure Defaults in github.com/go-vela/server. Affects github.com/go-vela/server versions < 0.16.0. Fixed in 0.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/go-vela/server package is a component of the Vela CI/CD system written in Go. It provides the server functionality for Vela, allowing users to manage and execute CI/CD pipelines. This package is vulnerable to insecure defaults, which can lead to potential security risks.
Vulnerability Detail
The Vela Insecure Defaults vulnerability in github.com/go-vela/server arises from the package's default configuration settings. These insecure defaults can expose sensitive information, allow unauthorized access, or enable malicious actions. Attackers may exploit this vulnerability to compromise the integrity, confidentiality, or availability of the Vela CI/CD system.
How To Fix
Latest published version: v0.28.10 as of 23 Oct 2026
go get github.com/go-vela/server@v0.28.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.16.0
This is the first release that contains the fix.
go get github.com/go-vela/server@v0.16.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is essential to apply the fix by upgrading to the recommended version.
Conclusion
The Vela Insecure Defaults vulnerability in github.com/go-vela/server exposes the Vela CI/CD system to potential security risks. It is crucial for users to upgrade to version 0.16.0 or later to address this vulnerability and ensure the security of their CI/CD pipelines.
See every vulnerability recorded for github.com/go-vela/server →
FAQ
This vulnerability can lead to potential security risks, including unauthorized access, exposure of sensitive information, and the ability to perform malicious actions within the Vela CI/CD system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock as a reference.
Yes, all versions prior to 0.16.0 are affected by this vulnerability. It is crucial to upgrade to the fixed version to mitigate the risk.
There is no known exploit available at the time of this report. However, it is recommended to apply the fix promptly to prevent any potential exploitation.
You can find more information about this vulnerability in the Vela Open Source Vulnerability Database at https://pkg.go.dev/vuln/GO-2022-1100.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-vela/server.
