KubeVela: a ComponentDefinition can point terraform.path at a symlink and OOM-kill the cluster-wide controller

Impact

Any user allowed to create or update ComponentDefinition objects can make vela-core clone a repository whose variables.tf or main.tf is a symlink to an unbounded stream such as /dev/zero. os.Stat and os.ReadFile follow the link and read without limit before any HCL parsing can reject it, so the controller exhausts memory and is OOM-killed. vela-core is cluster-wide: while it crash-loops, application delivery and reconciliation stop for every tenant on the cluster, not just the one who submitted the definition. If the controller Pod has no effective memory limit, the read also pressures the node it lands on, which on a GPU node means competing with pinned host memory for running training and serving workloads.

Who can reach it

An authenticated cluster user holding RBAC create or update on core.oam.dev/v1beta1 ComponentDefinition. No host or node access required; the controller does the outbound clone on the attacker's behalf.

What to do

Upgrade KubeVela to 1.9.14, 1.10.9, or 1.11.0-alpha.4 as stated in the advisory. This is a controller deployment upgrade - roll the vela-core Deployment; no node drain or reboot. In the meantime, tighten RBAC so only trusted operators can write ComponentDefinition objects, and set a memory limit on the vela-core container so a crash is contained to the Pod instead of the node.

References

Related entries

• CloudNativePG: managed-role passwords exposed via pg_stat_statements, enabling command execution in the DB podCVE-2026-55765 · CloudNativePG operator (managed-role password handling)High
• Docker / moby: Command execution via crafted remote git build path in `docker build`CVE-2019-13139 · Docker / mobyHigh
• Rancher: Sensitive data leaked into Rancher audit logsCVE-2023-22649 · RancherHigh
• runc: Insufficient checks when bind-mounting /dev/console allow writes to arbitrary host procfs pathsCVE-2025-52565 · runcHigh
• BuildKit: Custom frontend can craft an API message causing daemon compromiseCVE-2026-33747 · BuildKitHigh
• Helm: Crafted plugin writes its contents to an arbitrary filesystem location on install or updateCVE-2026-35204 · HelmHigh