What’s Vulnerable › Vulnerabilities

CVE-2022-39383: SSRF vulnerability in KubeVela VelaUX APIServer

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-16 · updated 2026-06-17
• Weakness: CWE-918

Description

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.

Affected products

• Linuxfoundation Kubevela: before 1.5.9; from 1.6.0 before 1.6.2 — fixed in 1.5.9, 1.6.2

How to fix

Upgrade to a fixed version: Linuxfoundation Kubevela 1.5.9, 1.6.2. Check the vendor advisory for mitigations.

References

• https://github.com/kubevela/kubevela/pull/5000
• https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7
• https://github.com/kubevela/kubevela/pull/5000
• https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7

Get alerted when CVE-2022-39383 or the next vulnerability affects your stack