CVE-2026-55108

KubeVela's Terraform remote configuration loader (GetTerraformConfigurationFromRemote in pkg/controller/utils/capability.go) follows repository-controlled symlinks for variables.tf and main.tf referenced by a core.oam.dev/v1beta1 ComponentDefinition, without bounding what the link resolves to. A user with permission to create or update ComponentDefinition objects can set terraform.path so that variables.tf points at /dev/zero, causing os.Stat and os.ReadFile to consume an unbounded stream before HCL parsing can reject the content. The resulting memory exhaustion can OOM-kill the cluster-wide vela-core controller, triggering repeated Pod restarts and, when no effective container memory limit is configured, node-level memory pressure; the CVSS vector also carries a low confidentiality component, yielding an overall High (8.5) score. Anyone running KubeVela prior to 1.9.14, 1.10.0-alpha.1 through before 1.10.9, or 1.11.0-alpha.1 through before 1.11.0-alpha.4 is affected, with practical exploitability limited to clusters that grant ComponentDefinition create/update rights to non-admin users. There is no known exploitation, no public proof-of-concept, and the flaw is not in CISA KEV; EPSS puts the 30-day exploitation probability at 0.6%.

What to do: Upgrade to KubeVela 1.9.14, 1.10.9, or 1.11.0-alpha.4 (or later) depending on your release line. Until patched, restrict create/update permissions on core.oam.dev/v1beta1 ComponentDefinition objects to trusted administrators and audit existing ComponentDefinitions for terraform.path values resolving to device files such as /dev/zero. Also ensure vela-core has effective container memory limits to contain any OOM blast radius, and monitor for unexpected controller Pod restarts.