CVE-2024-28236

CVE-2024-28236 is a medium-severity vulnerability affecting the go_vela worker in the Vela CI/CD framework. It allows for the exposure of secrets through variable substitution in insensitive fields like parameters, image, and entrypoint, bypassing log masking, particularly impacting secrets restricted by the "no commands" option. This can lead to unintended secret exposure during image execution, even when image and command restrictions are in place. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low attack complexity and no user interaction required, leading to high confidentiality impact. While it primarily affects how secrets are handled within plugins, it creates a false sense of security for users relying on "no commands" and image restrictions. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting a low level of public awareness or attention at this time.