CVE-2020-26294 - CVE House
Back to Database
Status published High CVE-2020-26294

Exposure of server configuration

Vulnerability Description

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26294

Credits & Attribution

No credits recorded in the NVD database.

References

More from go-vela

View All →
CVE-2025-27616
Vela Server has Insufficient Webhook Payload Data Verification
High 8.6
CVE-2024-28236
Insecure Variable Substitution in Vela
High 7.7
CVE-2022-39395
Vela Insecure Defaults
Critical 9.6
CVE-2021-21432
Reject unauthorized access with GitHub PATs
High 7.5

Affected Vendor

Affected Software

compiler
Vulnerable Versions:
< 0.6.1

Timeline

Official Publish: January 4th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration