Read the docs
TI-2019-15264 Aliases CVE-2019-25210

An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3.

Priority MEDIUM 48CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:-:*:*:*:*:*:*:*not specified by NVDVulnerablehelm
  • cpe:2.3:a:helm:helm:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·helm

Remediation

Red Hat 5 advisories

  • RHSA-2025:4019 Released 2025-04-22 · Red Hat rating Important
    OpenShift Container Platform 4.18.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-ibm-vpc-block-csi-driver-rhel9, openshift4/ose-monitoring-plugin-rhel9, openshift4/ose-operator-registry-rhel9 +1
  • RHSA-2024:6121 Released 2025-02-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.1 security and extras update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
  • RHSA-2024:0041 Released 2024-06-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
Show 2 more Red Hat advisories
  • RHSA-2024:1570 Released 2024-03-28 · Red Hat rating Important
    ACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:1549 Released 2024-03-27 · Red Hat rating Critical
    ACS 4.3 enhancement and security update
    • RHACS 4.3 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
RHACS 4.3 for RHEL 8Fixed RHSA-2024:1549
RHACS 4.4 for RHEL 8Fixed RHSA-2024:1570
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0041
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2024:6121, RHSA-2025:4019
Not affected: 10 products
  • OpenShift Service Mesh 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25210

References

Advisory 1

Other 2

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
  • TI-2024-17237 Helm's Missing YAML Content Leads To Panic CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences