CVE-2022-36089highCWE-294

CVE-2022-36089: high-severity vulnerability in kubevela

VelaUX APIServer vulnerable to Authentication Bypass by Capture-replay

Published · Updated

Follow this CVE+ Monitor kubevela

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.9%
KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected products
kubevela · kubevela
Related CVEs — kubevela

In the same product, most dangerous first.

CVE-2026-55108HIGHKubeVela Terraform remote loader DoS via unbounded file readEPSS 0.8%CVE-2022-39383MEDIUMSSRF vulnerability in KubeVela VelaUX APIServerEPSS 0.4%