CVE-2020-26294

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.

• CWE-78

• https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bdaPatch, Third Party Advisory
• https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68jExploit, Third Party Advisory
• https://pkg.go.dev/github.com/go-vela/compiler/compilerProduct, Third Party Advisory
• https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bdaPatch, Third Party Advisory
• https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68jExploit, Third Party Advisory
• https://pkg.go.dev/github.com/go-vela/compiler/compilerProduct, Third Party Advisory

Published

Jan 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26289date-and-time is an npm package for manipulating date and ti…7.5
• CVE-2020-2629Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26290Dex is a federated OpenID Connect provider written in Go. In…9.6
• CVE-2020-26291URI.js is a javascript URL mutation library (npm package uri…6.5
• CVE-2020-26292Creeper is an experimental dynamic, interpreted language. Th…9.8
• CVE-2020-26293HtmlSanitizer is a .NET library for cleaning HTML fragments …6.1
• CVE-2020-26295OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26296Vega is a visualization grammar, a declarative format for cr…8.7
• CVE-2020-26297mdBook is a utility to create modern online books from Markd…6.1
• CVE-2020-26298Redcarpet is a Ruby library for Markdown processing. In Redc…5.4
• CVE-2020-26299ftp-srv is an open-source FTP server designed to be simple y…9.6
• CVE-2020-2630Vulnerability in the Enterprise Manager Base Platform produc…6