Description

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository supplied through a core.oam.dev/v1beta1 ComponentDefinition and follows repository-controlled variables.tf or main.tf symlinks. A user with permission to create or update ComponentDefinition objects can point variables.tf to /dev/zero through terraform.path, after which os.Stat and os.ReadFile follow the link and read an unbounded stream before ParseTerraformVariables or HCL parsing can reject the content. The read can exhaust memory, OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory when no effective container limit is configured. This issue is fixed in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-28T20:18:24.337Z",
  "pubdate": "2026-08-28T20:18:24.337Z",
  "executiveSummary": "KubeVela is susceptible to a resource exhaustion vulnerability within its Terraform remote configuration loading mechanism, which can lead to a Denial of Service (DoS) condition.\nThe vulnerability originates from insecure file handling practices where the `GetTerraformConfigurationFromRemote` function fails to validate symbolic links within repository-controlled Terraform configurations.\nAn authenticated attacker possessing permissions to create or update `ComponentDefinition` objects can exploit this by directing Terraform paths to device files such as `/dev/zero`.\nThe subsequent attempt by the `vela-core` controller to read these files results in unbounded memory consumption, triggering OOM (Out of Memory) kills of the controller pod.\nThis vulnerability poses a significant risk to the stability of the entire delivery platform, as persistent OOM events can lead to recurring service outages and impact broader node memory availability if resource limits are not strictly enforced.\nSuccessful exploitation requires the attacker to have legitimate access to manage OAM (Open Application Model) components, making this an elevation of impact from authorized configuration management to cluster-wide service disruption.",
  "technicalDetails": "The vulnerability is located in the `pkg/controller/utils/capability.go` file within the `GetTerraformConfigurationFromRemote` function. This function is responsible for fetching and preparing Terraform configurations provided via `core.oam.dev/v1beta1` `ComponentDefinition` objects.\nThe root cause is an improper trust assumption regarding the contents of the remote repository. When the controller processes the `ComponentDefinition`, it clones the repository and relies on `os.Stat` and `os.ReadFile` to process critical configuration files such as `variables.tf` or `main.tf`.\nThe implementation fails to sanitize or resolve symbolic links provided by the attacker within the remote repository. An attacker can craft a repository where `variables.tf` is a symbolic link pointing to a special character device, specifically `/dev/zero`.\nThe attack flow proceeds as follows: First, the attacker creates or updates a `ComponentDefinition` that specifies a malicious repository URL. Second, the `vela-core` controller clones this repository. Third, the controller attempts to parse the Terraform variables. Because the code calls `os.ReadFile` on the path defined by the attacker, the underlying Go runtime follows the symlink to `/dev/zero`.\nBecause `/dev/zero` is an infinite source of null bytes, `os.ReadFile` continues to read from the device until the operation is interrupted by a memory limit or system failure. Since the controller attempts to buffer the content in memory before passing it to `ParseTerraformVariables` or the HCL (HashiCorp Configuration Language) parser, the process experiences rapid and unbounded memory growth.\nThe immediate impact is an OOM-kill event for the `vela-core` pod. Because the controller is responsible for core application delivery logic, its repeated crashing results in a significant Denial of Service. In environments lacking strict container-level resource quotas (memory limits), this uncontrolled memory allocation can cause resource pressure on the underlying Kubernetes node, potentially affecting other co-located workloads.\nThe vulnerability affects versions prior to 1.9.14, 1.10.0-alpha.1 through 1.10.9, and 1.11.0-alpha.1 through 1.11.0-alpha.4. Exploitation is limited to users with sufficient permissions to define components, reflecting an abuse of existing configuration management capabilities."
}