Executive brief
KubeVela's control-plane controller processes Terraform configurations from user-supplied git repositories. A user with permission to create or update ComponentDefinition objects can craft a malicious repository containing a symlink (e.g., `variables.tf` → `/dev/zero`) that causes the controller to read an infinite data stream into memory, triggering an out-of-memory crash. This denies the entire KubeVela control plane, preventing legitimate operations across the cluster.
Technical details
The vulnerability exists in `pkg/controller/utils/capability.go` within the `GetTerraformConfigurationFromRemote` function. When processing a user-supplied git repository URL in a ComponentDefinition's Terraform remote schematic, the code attempts to read `variables.tf` or `main.tf` using `os.ReadFile()` without verifying: (1) whether the target is a regular file or symlink; (2) whether the resolved path remains within the cache directory; or (3) file size bounds before reading. Both `os.Stat()` and `os.ReadFile()` follow symlinks, so a malicious repository containing `variables.tf → ../../../../../../dev/zero` will cause the controller to read indefinitely from `/dev/zero`, exhausting memory before HCL parsing can occur. The attack requires low privileges (ComponentDefinition create/update permission), no user interaction, and is network-reachable. Patches are available in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.
Affected products
- oam-dev kubevela < 1.9.14, >= 1.10.0-alpha.1 and < 1.10.9, >= 1.11.0-alpha.1 and < 1.11.0-alpha.4
Timeline
- 2026-06-30: disclosed
- 2026-08-28: advisory: Published to GitHub Advisory Database
- 2026-06-30: patched: Patches released in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4