What’s Vulnerable › Vulnerabilities

CVE-2020-26294: Exposure of server configuration

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-04 · updated 2026-06-17
• Weakness: CWE-78

Description

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.

Affected products

• go-vela compiler: before 0.6.1 — fixed in 0.6.1

How to fix

Upgrade to a fixed version: go-vela compiler 0.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bda
• https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68j
• https://pkg.go.dev/github.com/go-vela/compiler/compiler
• https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bda
• https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68j
• https://pkg.go.dev/github.com/go-vela/compiler/compiler

Get alerted when CVE-2020-26294 or the next vulnerability affects your stack