CVE-2026-55108

Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.9.14 KubeVela versions 1.10.0-alpha.1 through 1.10.8 KubeVela versions 1.11.0-alpha.1 through 1.11.0-alpha.3

Description The Terraform remote configuration loader in KubeVela can be abused to cause a denial of service of the control plane. A user with permissions to create or update core.oam.dev/v1beta1 ComponentDefinition objects can register a Terraform remote schematic pointing to a malicious git repository. If the repository contains a variables.tf or main.tf symlink that resolves to /dev/zero, the GetTerraformConfigurationFromRemote() function in pkg/controller/utils/capability.go will follow the link and read an unbounded byte stream into memory using os.ReadFile(). This occurs before HCL parsing can reject the content, leading to memory exhaustion that can OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory if no container limits are configured.

Recommendations Update to version 1.9.14. Update to version 1.10.9. Update to version 1.11.0-alpha.4.