{"cve":"CVE-2022-36089","nvd":{"published":"2022-09-07T23:15:14.240","modified":"2026-06-17T04:52:53.787","status":"Modified","description":"KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-294"],"references":["https://github.com/kubevela/kubevela/pull/4634","https://github.com/kubevela/kubevela/security/advisories/GHSA-cq42-w295-r29q","https://github.com/kubevela/kubevela/pull/4634","https://github.com/kubevela/kubevela/security/advisories/GHSA-cq42-w295-r29q"],"products":["kubevela:kubevela"],"source":"nvd","synced_at":"2026-10-19T21:35:14.992143698+00:00"},"epss":{"cve":"CVE-2022-36089","score":0.00892,"percentile":0.59434,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}