Read the docs
TI-2020-08887 Aliases CVE-2020-11013GHSA-q8q8-93cv-v6h8

lookup Function Information Discolosure in Helm

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0

Why it matters now

EPSS 0.01412 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Helm (helm): 3.2.0helm.sh/helm/v3 (Go): 3.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
helmHelm3.1.0 to before 3.2.03.2.0Patch availableCNA
—helm.sh/helm/v3 (Go)3.0.0 to before 3.1.33.1.3Patch availableGHSA-q8q8-93cv-v6h8
  • Helm Vendorhelm Affected 3.1.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA
  • helm.sh/helm/v3 (Go) Vendor— Affected 3.0.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-q8q8-93cv-v6h8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*3.1.0 to before 3.2.0Vulnerablehelm
  • cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.2.0 Vulnerable ·helm

Remediation

  • Fix · CNA Helm (helm) Fixed in 3.2.0
  • Fix · GHSA-q8q8-93cv-v6h8 helm.sh/helm/v3 (Go) Fixed in 3.1.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11013
  2. 2026-10-03 Alias added: GHSA-q8q8-93cv-v6h8
  3. 2026-10-14 Priority changed: LOW → MEDIUM

References

Exploit 1

Advisory 2

Other 2

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences