Helm - vulnerabilities (CVEs)

30 CVEs in 2 products, 0 in the last 30 days, newest from 2026-07-17.

Products

Helm - 29 CVEs
Chartmuseum - 1 CVEs

Newest CVEs of Helm

CVE-2026-63308 - CVSS 6.5 (medium), 2026-07-17: Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows…
CVE-2026-35206 - CVSS 4.8 (medium), 2026-04-09: Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL…
CVE-2026-35204 - CVSS 8.6 (high), 2026-04-09: Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write…
CVE-2026-35205 - CVSS 8.4 (high), 2026-04-09: Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature…
CVE-2025-55199 - CVSS 6.5 (medium), 2025-08-14: Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to…
CVE-2025-55198 - CVSS 6.5 (medium), 2025-08-14: Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type…
CVE-2025-53547 - CVSS 8.6 (high), 2025-07-08: Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can…
CVE-2025-32387 - CVSS 6.5 (medium), 2025-04-09: Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to…
CVE-2025-32386 - CVSS 6.5 (medium), 2025-04-09: Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed…
CVE-2019-25210 - CVSS 9.1 (critical), 2024-03-03: An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This…
CVE-2024-26147 - CVSS 7.5 (high), 2024-02-21: Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and…
CVE-2024-25620 - CVSS 6.4 (medium), 2024-02-15: Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart…
CVE-2023-25165 - CVSS 4.3 (medium), 2023-02-08: Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The…
CVE-2022-23526 - CVSS 7.5 (high), 2022-12-15: Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_…
CVE-2022-23525 - CVSS 7.5 (high), 2022-12-15: Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the…
CVE-2022-23524 - CVSS 7.5 (high), 2022-12-15: Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting…
CVE-2022-36049 - CVSS 7.7 (high), 2022-09-07: Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to…
CVE-2022-36055 - CVSS 6.5 (medium), 2022-09-01: Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to…
CVE-2021-32690 - CVSS 8.6 (high), 2021-06-16: Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the…
CVE-2021-21303 - CVSS 6.8 (medium), 2021-02-05: Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured…
CVE-2020-15186 - CVSS 3.4 (low), 2020-09-17: In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin…
CVE-2020-15185 - CVSS 2.7 (low), 2020-09-17: In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is…
CVE-2020-15187 - CVSS 4.7 (medium), 2020-09-17: In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised,…
CVE-2020-15184 - CVSS 3.7 (low), 2020-09-17: In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the…
CVE-2020-4053 - CVSS 6.8 (medium), 2020-06-16: In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It…
CVE-2020-11013 - CVSS 8.5 (high), 2020-04-24: Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm…
CVE-2019-18658 - CVSS 9.8 (critical), 2019-11-12: In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart…
CVE-2019-1010275 - CVSS 9.8 (critical), 2019-07-17: helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because…
CVE-2019-1000008 - CVSS 6.5 (medium), 2019-02-04: All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2019-1000009 - CVSS 6.5 (medium), 2019-02-04: Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability…