CVE-2025-27616

Summary

CVE-2025-27616 is a vulnerability affecting Vela, a Linux container-based CI/CD framework written in Golang, prior to versions 0.25.3 and 0.26.3. An attacker can hijack repository ownership and exfiltrate repo-level secrets by spoofing a webhook payload with specific headers and body data. This vulnerability impacts users with enabled repositories containing CI secrets in Vela, and anyone with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 have addressed this issue, and no known workarounds are currently available.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.