CVE-2021-21432 - CVE House
Back to Database
Status published High CVE-2021-21432

Reject unauthorized access with GitHub PATs

Vulnerability Description

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21432

Credits & Attribution

No credits recorded in the NVD database.

References

More from go-vela

View All →
CVE-2025-27616
Vela Server has Insufficient Webhook Payload Data Verification
High 8.6
CVE-2024-28236
Insecure Variable Substitution in Vela
High 7.7
CVE-2022-39395
Vela Insecure Defaults
Critical 9.6
CVE-2020-26294
Exposure of server configuration
High 7.4

Affected Vendor

Affected Software

server
Vulnerable Versions:
>= 0.7.0, < 0.7.5

Timeline

Official Publish: April 9th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion