CVE-2022-36089

HIGH

KubeVela <1.4.11, <1.5.4 - Auth Bypass

Title source: llm

Description

KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.

References (2)

Scores

CVSS v3 8.2
EPSS 0.0034
EPSS Percentile 56.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Classification

CWE
CWE-294
Status published

Affected Products (1)

kubevela/kubevela < 1.4.11

Timeline

Published Sep 07, 2022
Tracked Since Feb 18, 2026