Duplicate plugin entries in Helm
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| helm | helm | 2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2 | 2.16.11, 3.3.2 | Patch available | CNA |
| — | helm.sh/helm/v3 (Go) | 3.0.0 to before 3.3.2 | 3.3.2 | Patch available | GHSA-c52f-pq47-2r9j |
| — | helm.sh/helm (Go) | 2.0.0 to before 2.16.11 | 2.16.11 | Patch available | GHSA-c52f-pq47-2r9j |
- helm Vendorhelm Affected 2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2 Fixed in 2.16.11, 3.3.2 Patch available CNA
- helm.sh/helm/v3 (Go) Vendor— Affected 3.0.0 to before 3.3.2 Fixed in 3.3.2 Patch available GHSA-c52f-pq47-2r9j
- helm.sh/helm (Go) Vendor— Affected 2.0.0 to before 2.16.11 Fixed in 2.16.11 Patch available GHSA-c52f-pq47-2r9j
Remediation
- Fix · CNA helm (helm) Fixed in 2.16.11, 3.3.2
- Fix · GHSA-c52f-pq47-2r9j helm.sh/helm/v3 (Go) Fixed in 3.3.2 Advisory →
- Fix · GHSA-c52f-pq47-2r9j helm.sh/helm (Go) Fixed in 2.16.11 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15187
- 2026-10-03 Alias added: GHSA-c52f-pq47-2r9j
References
Advisory 2
Other 6
- https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946
- https://github.com/helm/helm/commit/ac7c07c37d87e09797f714fb57aa5e9cb99d9450
- https://github.com/helm/helm/commit/b0296c0522e837d65f944beefa3fb64fd08ac304
- https://github.com/helm/helm/commit/c8d6b01d72c9604e43ee70d0d78fadd54c2d8499
- https://github.com/helm/helm/commit/f2ede29480b507b7d8bb152dd8b6b86248b00658
- https://github.com/helm/helm
More Helm vulnerabilities
- TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
- TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
- TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
- TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
- TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
- TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
Sources
- CVE-2020-15187 · CVE Program
- CVE-2020-15187 · NVD
- FIRST EPSS
- GHSA-c52f-pq47-2r9j · GitHub Advisory Database · CC BY 4.0
- CVE-2020-15187 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences