Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-39395

30
FAUCET Score

CVE-2022-39395 is a critical vulnerability affecting Vela Server, Worker, and UI versions prior to 0.16.0 and 0.17.0 respectively, stemming from insecure default configurations that allow exploitation and container breakouts within the CI/CD framework. With a CVSS score of 9.9, this vulnerability presents a critical risk (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning it can be exploited remotely with low complexity by a low-privileged attacker, leading to complete compromise of confidentiality, integrity, and availability. While the vulnerability is not currently on the KEV catalog or Hot List, and there is no known public exploit code or significant community discussion, immediate patching to the recommended versions (Server 0.16.0, Worker 0.16.0, UI 0.17.0) and subsequent configuration adjustments are crucial to mitigate the high risk exposure.

Impacted Technologies

VendorProductVersion(s)CPE
< 0.16.0CPE matchmatch criteria
cpe:2.3:a:go-vela:server:*:*:*:*:*:*:*:*
< 0.17.0CPE matchmatch criteria
cpe:2.3:a:go-vela:ui:*:*:*:*:*:*:*:*
< 0.16.0CPE matchmatch criteria
cpe:2.3:a:go-vela:worker:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.6CRITICAL

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.07%
Probability of exploitation in next 30 days
EPSS Percentile
61.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0107 is in the 68th percentile among its peer group of 1,128 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
gopatch availablevia ghsa
Product: github.com/go-vela/serverFixed in: 0.16.0
gopatch availablevia ghsa
Product: github.com/go-vela/workerFixed in: 0.16.0

Vendor Advisories (1)

goGHSA-5m7g-pj8w-7593critical

Vela Insecure Defaults

Nov 9, 2022

References

docs.docker.com / engine/security
Technical DescriptionThird Party Advisory
github.com / go-vela/server/commit/05558ee99d70f7d6f83bed7c8f78ac0b35fa26f4
PatchThird Party Advisory
github.com / go-vela/server/releases/tag/v0.16.0
Release NotesThird Party Advisory
github.com / go-vela/server/security/advisories/GHSA-5m7g-pj8w-7593
Third Party Advisory
github.com / go-vela/ui/releases/tag/v0.17.0
Release NotesThird Party Advisory
github.com / go-vela/ui/security/advisories/GHSA-xf39-98m2-889v
Third Party Advisory
github.com / go-vela/worker/releases/tag/v0.16.0
Release NotesThird Party Advisory
github.com / go-vela/worker/security/advisories/GHSA-2w78-ffv6-p46w
Third Party Advisory
go-vela.github.io / docs/installation/server/reference
Vendor Advisory
go-vela.github.io / docs/installation/worker/reference
Vendor Advisory