CVE-2021-21432: Go-Vela Vela

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

Affected products

• Go-Vela Vela: before 0.7.5 (fixed in 0.7.5)

Published 2021-04-09. Last modified 2026-06-17.