CVE-2022-39395

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to Server 0.16.0, Worker 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to explicitly change the default settings to configure Vela as desired. Some of the fixes will interrupt existing workflows and will require Vela administrators to modify default settings. However, not applying the patch (or workarounds) will continue existing risk exposure. Some workarounds are available. Vela administrators can adjust the worker's `VELA_RUNTIME_PRIVILEGED_IMAGES` setting to be explicitly empty, leverage the `VELA_REPO_ALLOWLIST` setting on the server component to restrict access to a list of repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull_requests if they are not needed.

• CWE-269
• CWE-269

• https://docs.docker.com/engine/security/#docker-daemon-attack-surfaceTechnical Description, Third Party Advisory
• https://github.com/go-vela/server/commit/05558ee99d70f7d6f83bed7c8f78ac0b35fa26f4Patch, Third Party Advisory
• https://github.com/go-vela/server/releases/tag/v0.16.0Release Notes, Third Party Advisory
• https://github.com/go-vela/server/security/advisories/GHSA-5m7g-pj8w-7593Third Party Advisory
• https://github.com/go-vela/ui/releases/tag/v0.17.0Release Notes, Third Party Advisory
• https://github.com/go-vela/ui/security/advisories/GHSA-xf39-98m2-889vThird Party Advisory
• https://github.com/go-vela/worker/releases/tag/v0.16.0Release Notes, Third Party Advisory
• https://github.com/go-vela/worker/security/advisories/GHSA-2w78-ffv6-p46wThird Party Advisory
• https://go-vela.github.io/docs/installation/server/reference/#vela_repo_allowlistVendor Advisory
• https://go-vela.github.io/docs/installation/worker/reference/#vela_runtime_privileged_imagesVendor Advisory
• https://docs.docker.com/engine/security/#docker-daemon-attack-surfaceTechnical Description, Third Party Advisory
• https://github.com/go-vela/server/commit/05558ee99d70f7d6f83bed7c8f78ac0b35fa26f4Patch, Third Party Advisory
• https://github.com/go-vela/server/releases/tag/v0.16.0Release Notes, Third Party Advisory
• https://github.com/go-vela/server/security/advisories/GHSA-5m7g-pj8w-7593Third Party Advisory
• https://github.com/go-vela/ui/releases/tag/v0.17.0Release Notes, Third Party Advisory
• https://github.com/go-vela/ui/security/advisories/GHSA-xf39-98m2-889vThird Party Advisory
• https://github.com/go-vela/worker/releases/tag/v0.16.0Release Notes, Third Party Advisory
• https://github.com/go-vela/worker/security/advisories/GHSA-2w78-ffv6-p46wThird Party Advisory
• https://go-vela.github.io/docs/installation/server/reference/#vela_repo_allowlistVendor Advisory
• https://go-vela.github.io/docs/installation/worker/reference/#vela_runtime_privileged_imagesVendor Advisory

Published

Nov 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39389Lightning Network Daemon (lnd) is an implementation of a lig…6.5
• CVE-2022-3939A vulnerability, which was classified as critical, has been …9.8
• CVE-2022-39390Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-39392Wasmtime is a standalone runtime for WebAssembly. Prior to v…7.4
• CVE-2022-39393Wasmtime is a standalone runtime for WebAssembly. Prior to v…8.6
• CVE-2022-39394Wasmtime is a standalone runtime for WebAssembly. Prior to v…9.8
• CVE-2022-39396Parse Server is an open source backend that can be deployed …9.8
• CVE-2022-39397aliyun-oss-client is a rust client for Alibaba Cloud OSS. Us…4.3
• CVE-2022-39398tasklists is a tasklists plugin for GLPI (Kanban). Versions …6.1
• CVE-2022-39399Vulnerability in the Oracle Java SE, Oracle GraalVM Enterpri…3.7
• CVE-2022-3940A vulnerability, which was classified as problematic, was fo…9.8
• CVE-2022-39400Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9