An authenticated user can exploit a symlink following flaw in KubeVela to cause a cluster wide denial of service via memory exhaustion.

The Terraform remote configuration loader improperly handles symlinks, allowing an authenticated user with permissions to create or update ComponentDefinition objects to point to system files like /dev/zero. This forces the controller to read an unbounded stream, resulting in memory exhaustion and potential OOM-kills of the vela-core controller.

The vulnerability poses a significant risk to platform availability, as a successful exploit can crash the primary KubeVela controller and impact cluster-wide application delivery operations. With a CVSS score of 8.5, this high-severity flaw enables an authenticated attacker to disrupt critical infrastructure, leading to service downtime and operational instability for all managed applications.

Immediate Action: Upgrade KubeVela to version 1.9.14, 1.10.9, or 1.11.0-alpha.4 as appropriate for your deployment branch.

Proactive Monitoring: Monitor the memory utilization of the vela-core controller pod and alert on repeated restart loops or OOM-kill events.

Compensating Controls: Restrict the ability to create or update ComponentDefinition objects to only highly trusted administrative users to limit the attack surface.

Public Exploit Available: Unknown.

Given the potential for cluster-wide denial of service, organizations should prioritize patching their KubeVela installations to the provided fixed versions. Ensure that strict access control policies are enforced for ComponentDefinition objects to prevent unauthorized users from leveraging this functionality to destabilize the platform.