CVE-2025-27616:
Vela Server Has Insufficient Webhook Payload Data Verification
8.6
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.11711%
CWE
Published
3/10/2025
Updated
3/14/2025
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-vela/server | go | < 0.25.3 | 0.25.3 |
| github.com/go-vela/server | go | >= 0.26.0, <= 0.26.2 | 0.26.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insufficient validation in webhook processing. Key issues include:
- The PostWebhook function initially lacked proper webhook signature verification using stored repo secrets (added in patch 67c1892)
- Repository event handling trusted payload data over database state, enabling spoofed ownership transfers
- CORS misconfigurations (patched in 257886e) could facilitate cross-origin attacks, though the primary vulnerability was in webhook auth
- The processRepositoryEvent function didn't validate payload completeness, risking nil pointer exploitation Patch commits show critical security checks were added to webhook validation flows and repository data handling.