CVE-2026-55108 affects KubeVela, an open source application delivery platform, across multiple versions prior to 1.9.14, 1.10.9, and 1.11.0-alpha.4. The vulnerability exists in the Terraform remote configuration loader within pkg/controller/utils/capability.go, specifically in the GetTerraformConfigurationFromRemote function. An attacker with permission to create or update ComponentDefinition objects can exploit symlink following behavior to point variables.tf to /dev/zero or similar unbounded streams. This causes os.Stat and os.ReadFile to read unlimited data before any parsing validation occurs, leading to memory exhaustion. The attack can OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory especially when no effective container limits are configured. Patches have been released in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.
