Read the docs
TI-2024-17237 Aliases CVE-2024-26147GHSA-r53h-jv2g-vpx6

Helm's Missing YAML Content Leads To Panic

Priority MEDIUM 41CWE-457Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-457 and the CVSS impact.

Summary

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use `recover` to catch the panic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00926 60th percentileScored 2026-11-07
Fix Partial helm (helm): 3.14.2helm.sh/helm/v3 (Go): 3.14.2Red Hat: 9 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
helmhelmbefore 3.14.23.14.2Patch availableCNA
—helm.sh/helm/v3 (Go)before 3.14.23.14.2Patch availableGHSA-r53h-jv2g-vpx6
  • helm Vendorhelm Affected before 3.14.2 Fixed in 3.14.2 Patch available CNA
  • helm.sh/helm/v3 (Go) Vendor— Affected before 3.14.2 Fixed in 3.14.2 Patch available GHSA-r53h-jv2g-vpx6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*before 3.14.2Vulnerablehelm
  • cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions before 3.14.2 Vulnerable ·helm

Remediation

  • Fix · CNA helm (helm) Fixed in 3.14.2
  • Fix · GHSA-r53h-jv2g-vpx6 helm.sh/helm/v3 (Go) Fixed in 3.14.2 Advisory →

Red Hat 9 advisories

  • RHSA-2025:4177 Released 2025-04-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-baremetal-rhel8-operator, openshift4/ose-cluster-etcd-rhel8-operator +4
  • RHSA-2024:6013 Released 2024-09-05 · Red Hat rating Important
    OpenShift Container Platform 4.15.30 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-console, rhcos
  • RHSA-2024:4626 Released 2024-07-18 · Red Hat rating Moderate
    Errata Advisory for Red Hat OpenShift GitOps v1.11.6 security update
    • Red Hat OpenShift GitOps 1.11 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6
Show 6 more Red Hat advisories
  • RHSA-2024:4156 Released 2024-07-03 · Red Hat rating Important
    OpenShift Container Platform 4.16.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-console-rhel9, openshift4/ose-telemeter-rhel9
  • RHSA-2024:4163 Released 2024-06-27 · Red Hat rating Moderate
    Errata Advisory for Red Hat OpenShift GitOps v1.12.4 security update
    • Red Hat OpenShift GitOps 1.12 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2024:2865 Released 2024-05-21 · Red Hat rating Important
    OpenShift Container Platform 4.15.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-cloud-node-manager-rhel9, openshift4/ose-azure-cluster-api-controllers-rhel9 +3
  • RHSA-2024:1570 Released 2024-03-28 · Red Hat rating Important
    ACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:1549 Released 2024-03-27 · Red Hat rating Critical
    ACS 4.3 enhancement and security update
    • RHACS 4.3 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +8
  • RHSA-2024:1328 Released 2024-03-14 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.9.3 security and bug fix container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
RHACS 4.3 for RHEL 8Fixed RHSA-2024:1549
RHACS 4.4 for RHEL 8Fixed RHSA-2024:1570
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8Fixed RHSA-2024:1328
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:4177
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:2865, RHSA-2024:6013
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:4156
Red Hat OpenShift GitOps 1.11Fixed RHSA-2024:4626
Red Hat OpenShift GitOps 1.12Fixed RHSA-2024:4163
Not affected: 12 products
  • OpenShift Service Mesh 2
  • RHACS 4.4 for RHEL 8
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-26147
  2. 2026-10-03 Alias added: GHSA-r53h-jv2g-vpx6
  3. 2026-11-04 Fix available: RHSA-2025:4177 · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences