Read the docs

helm

Records30All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

helm records in CISA KEV

No helm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Helm 29 records MEDIUM Chartmuseum 1 record LOW

Records

29 records in Helm · all components

TI-2026-45154 CVE-2026-63308 · GHSA-5gjx-96wq-c8r2

Helm Files.Lines Denial of Service via Empty Chart Files

Priority MEDIUM 57

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00486 Published 2026-07-17 Partial fix CWE-129
TI-2023-10627 CVE-2023-25165 · GHSA-pwcw-6f5g-gxf8

getHostByName Function Information Disclosure

Priority MEDIUM 53

Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00768 Published 2023-02-08 Partial fix · 3.11.1 CWE-200
TI-2019-13497 CVE-2019-18658 · GHSA-p5pc-m4q7-7qm9

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or…

Priority MEDIUM 46

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01745 Published 2019-11-12 Fixed in 2.15.2 CWE-59
TI-2019-16052 CVE-2019-1010275 · GHSA-x6r5-vxfg-gq3v

Improper certificate validation in helm

Priority MEDIUM 45

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01358 Published 2019-07-17 Fixed in 2.7.2 CWE-295
TI-2024-17237 CVE-2024-26147 · GHSA-r53h-jv2g-vpx6

Helm's Missing YAML Content Leads To Panic

Priority MEDIUM 41

Helm is a package manager for Charts for Kubernetes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00926 Published 2024-02-21 Partial fix · 3.14.2 CWE-457
TI-2022-07585 CVE-2022-23526 · GHSA-67fx-wx78-jx33

Helm contains Denial of service through schema file

Priority MEDIUM 41

Helm is a tool for managing Charts, pre-configured Kubernetes resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00888 Published 2022-12-15 Partial fix · v3.10.3, 3.10.3 CWE-476
TI-2021-12358 CVE-2021-32690 · GHSA-56hp-xqp3-w2jf

Repository credentials passed to alternate domain

Priority MEDIUM 40

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01434 Published 2021-06-16 Partial fix · 3.6.1 CWE-200
TI-2020-08887 CVE-2020-11013 · GHSA-q8q8-93cv-v6h8

lookup Function Information Discolosure in Helm

Priority MEDIUM 40

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.01412 Published 2020-04-24 Fixed in 3.2.0, 3.1.3 CWE-200
TI-2022-16473 CVE-2022-36049 · GHSA-p2g7-xwvr-rrw3

Flux2 Helm Controller denial of service

Priority LOW 37

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01542 Published 2022-09-07 Fixed in 0.23.0, 0.32.0 CWE-400
TI-2020-03542 CVE-2020-4053 · GHSA-qq3j-xp49-j73f

Path Traversal in Helm Plugin Archive

Priority LOW 33

In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.01458 Published 2020-06-16 Fixed in 3.2.4 CWE-22
TI-2021-04403 CVE-2021-21303 · GHSA-c38g-469g-cmgx

Injection attack in Helm

Priority LOW 32

Helm is open-source software which is essentially "The Kubernetes Package Manager".

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.01086 Published 2021-02-05 Fixed in 3.5.2 CWE-74
TI-2019-15825 CVE-2019-1000008 · GHSA-xrxm-mvqm-r553

All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper…

Priority LOW 32

All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint s…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01483 Published 2019-02-04 Fixed in 2.12.2 CWE-22
TI-2022-16478 CVE-2022-36055 · GHSA-7hfp-qfw3-5jxh

Denial of service in Helm

Priority LOW 31

Helm is a tool for managing Charts.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01118 Published 2022-09-01 Partial fix · 3.9.4 CWE-400
TI-2025-34874 CVE-2025-55198 · GHSA-f9f8-9pmf-xv68

Helm May Panic Due To Incorrect YAML Content

Priority LOW 29

Helm is a package manager for Charts for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00354 Published 2025-08-13 Partial fix · 3.18.5 CWE-908
TI-2020-11959 CVE-2020-15187 · GHSA-c52f-pq47-2r9j

Duplicate plugin entries in Helm

Priority LOW 25

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.01517 Published 2020-09-17 Partial fix · 2.16.11, 3.3.2 CWE-694
Load more
Open these records in search →