CVE-2022-39383mediumCWE-918

CVE-2022-39383: medium-severity vulnerability in kubevela

SSRF vulnerability in KubeVela VelaUX APIServer

Published · Updated

Follow this CVE+ Monitor kubevela+ Monitor github.com/oam-dev/kubevela

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.4%
KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
kubevela · kubevela
Related CVEs — kubevela

In the same product, most dangerous first.

CVE-2022-36089HIGHVelaUX APIServer vulnerable to Authentication Bypass by Capture-replayEPSS 0.9%CVE-2026-55108HIGHKubeVela Terraform remote loader DoS via unbounded file readEPSS 0.8%