Every CVE Search/ Get API key

CVE-2024-26147

Helm's Missing YAML Content Leads To Panic

7.5 HighFix available

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.93%Up 0.9 points since Feb 22, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

Helm's Missing YAML Content Leads To Panic

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
CVE-2024-26147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-457
Updated
2026-11-02
EUVDEUVD-2024-0709 7.5

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
EUVD-2024-0709
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-r53h-jv2g-vpx6 8.7

Helm's Missing YAML Content Leads To Panic

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Impact

When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.

In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.

Patches

This issue has been resolved in Helm v3.14.2.

Workarounds

If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Record
GHSA-r53h-jv2g-vpx6
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-457, CWE-908
Updated
2026-11-02
NVD 7.5

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
CVE-2024-26147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-457, CWE-908
Updated
2026-11-02
OSVAZL-34454 7.5

CVE-2024-26147 affecting package cert-manager for versions less than 1.11.2-10

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
AZL-34454
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-34584 7.5

CVE-2024-26147 affecting package cert-manager for versions less than 1.12.13-1

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
AZL-34584
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVAZL-38497 7.5

CVE-2024-26147 affecting package helm for versions less than 3.13.2-3

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
AZL-38497
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Helm's Missing YAML Content Leads To Panic

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
CVE-2024-26147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-457
Updated
2026-11-02
OSVGHSA-r53h-jv2g-vpx6 8.7

Helm's Missing YAML Content Leads To Panic

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Impact

When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.

In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.

Patches

This issue has been resolved in Helm v3.14.2.

Workarounds

If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Record
GHSA-r53h-jv2g-vpx6
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-457, CWE-908
Updated
2026-11-02
OSVUBUNTU-CVE-2024-26147 7.5

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
UBUNTU-CVE-2024-26147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-helm-2024-26147 No score

Helm's Missing YAML Content Leads To Panic

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

Record
BIT-helm-2024-26147
Updated
2026-11-02
OSVGO-2024-2575 No score

Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3

Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3

Record
GO-2024-2575
Updated
2026-11-02
OSVopenSUSE-SU-2024:13708-1 No score

helm-3.14.2-1.1 on GA media

These are all security issues fixed in the helm-3.14.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13708-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13778-1 No score

cmctl-1.14.4-1.1 on GA media

These are all security issues fixed in the cmctl-1.14.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13778-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13918-1 No score

k9s-0.32.4-2.1 on GA media

These are all security issues fixed in the k9s-0.32.4-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13918-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15779-1 No score

helm3-3.19.2-1.1 on GA media

These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15779-1
Updated
2026-11-02
OSVSUSE-RU-2024:4213-1 No score

Recommended update for helm

helm was updated to fix the following issues:

Update to version 3.16.3:

  • fix: fix label name
  • Fix typo in pkg/lint/rules/chartfile_test.go
  • Increasing the size of the runner used for releases.
  • fix(hooks): correct hooks delete order
  • Bump github.com/containerd/containerd from 1.7.12 to 1.7.23

Update to version 3.16.2:

  • Revering change unrelated to issue #13176
  • adds tests for handling of Helm index with broken chart versions #13176
  • improves handling of Helm index with broken helm chart versions #13176
  • Bump the k8s-io group with 7 updates
  • adding check-latest:true
  • Grammar fixes
  • Fix typos

Update to version 3.16.1:

  • bumping version to 1.22.7
  • Merge pull request #13327 from mattfarina/revert-11726

Update to version 3.16.0:

Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience.

  • Notable Changes
    • added sha512sum template function
    • added ActiveHelp for cmds that don't take any more args
    • drops very old Kubernetes versions support in helm create
    • add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint'
    • fixed bug to now use burst limit setting for discovery
    • Added windows arm64 support
  • Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0

Update to version 3.15.4:

  • Bump the k8s-io group across 1 directory with 7 updates
  • Bump github.com/docker/docker

Thu Jul 11 05:39:32 UTC 2024 - [email protected]

  • Update to version 3.15.3:
    • fix(helm): Use burst limit setting for discovery
    • fixed dependency_update_test.go
    • fix(dependencyBuild): prevent race condition in concurrent helm dependency
    • fix: respect proxy envvars on helm install/upgrade
    • Merge pull request #13085 from alex-kattathra-johnson/issue-12961

Update to version 3.15.2:

  • fix: wrong cli description
  • fix typo in load_plugins.go
  • fix docs of DeployedAll
  • Bump github.com/docker/docker
  • bump oras minor version
  • feat(load.go): add warning on requirements.lock

Update to version 3.15.1:

  • Fixing build issue where wrong version is used

Update to version 3.15.0:

Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience.

  • Updating to k8s 1.30 c4e37b3 (Matt Farina)
  • bump version to v3.15.0 d7afa3b (Matt Farina)
  • bump version to 7743467 (Matt Farina)
  • Fix namespace on kubeconfig error 214fb6e (Calvin Krist)
  • Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk M�ller)
  • Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block)
  • Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina)
  • Fixing all the linting errors d58d7b3 (Robert Sirchia)
  • Add a note about --dry-run displaying secrets a23dd9e (Matt Farina)
  • Updating .gitignore 8b424ba (Robert Sirchia)
  • add error messages 8d19bcb (George Jenkins)
  • Fix: Ignore alias validation error for index load 68294fd (George Jenkins)
  • validation fix 8e6a514 (Matt Farina)
  • bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini)
  • Update architecture detection method 57a1bb8 (weidongkl)
  • Improve release action 4790bb9 (George Jenkins)
  • Fix grammatical error c25736c (Matt Carr)
  • Updated for review comments d2cf8c6 (MichaelMorris)
  • Add robustness to wait status checks fc74964 (MichaelMorris)
  • refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov)
  • fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov)

Update to version 3.14.4:

Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

  • refactor: create a helper for checking if a release is …
Record
SUSE-RU-2024:4213-1
Updated
2026-11-02
OSVSUSE-SU-2024:1137-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2024-25620: Fixed with dependency management path traversal (bsc#1219969).
  • CVE-2024-26147: Fixed uninitialized variable in yaml parsing (bsc#1220207).
Record
SUSE-SU-2024:1137-1
Updated
2026-11-02
OSVSUSE-SU-2025:20196-1 No score

Security update for helm

This update for helm fixes the following issues:

  • Update to version 3.17.2 (bsc#1238688, CVE-2025-22870):

    • Updating to 0.37.0 for x/net
    • build(deps): bump the k8s-io group with 7 updates

  • Update to version 3.17.1:

    • merge null child chart objects
    • build(deps): bump the k8s-io group with 7 updates
    • fix: check group for resource info match

  • Update to 3.17.0 (bsc#1235318, CVE-2024-45338):

    Full changelog:

    https://github.com/helm/helm/releases/tag/v3.17.0

    • Notable Changes

      • Allow pulling and installation by OCI digest
      • Annotations and dependencies are now in chart metadata output
      • New --take-ownership flag for install and upgrade commands
      • SDK: Authorizer and registry authorizer are now configurable
      • Removed the Kubernetes configuration file permissions check
      • Added username/password to helm push and dependency build/update subcommands
      • Added toYamlPretty template function

  • Update to version 3.16.4 (bsc#1234482, CVE-2024-45337):

    • Bump golang.org/x/crypto from 0.30.0 to 0.31.0
    • Bump the k8s-io group with 7 updates
Record
SUSE-SU-2025:20196-1
Updated
2026-11-02
OSVSUSE-SU-2025:20278-1 No score

Security update for helm

This update for helm fixes the following issues:

  • Update to version 3.17.2 (bsc#1238688, CVE-2025-22870):

    • Updating to 0.37.0 for x/net
    • build(deps): bump the k8s-io group with 7 updates

  • Update to version 3.17.1:

    • merge null child chart objects
    • build(deps): bump the k8s-io group with 7 updates
    • fix: check group for resource info match

  • Update to 3.17.0 (bsc#1235318, CVE-2024-45338):

    Full changelog: https://github.com/helm/helm/releases/tag/v3.17.0

    • Notable Changes

      • Allow pulling and installation by OCI digest
      • Annotations and dependencies are now in chart metadata output
      • New --take-ownership flag for install and upgrade commands
      • SDK: Authorizer and registry authorizer are now configurable
      • Removed the Kubernetes configuration file permissions check
      • Added username/password to helm push and dependency build/update subcommands
      • Added toYamlPretty template function

  • Update to version 3.16.4 (bsc#1234482, CVE-2024-45337):

    • Bump golang.org/x/crypto from 0.30.0 to 0.31.0
    • Bump the k8s-io group with 7 updates
Record
SUSE-SU-2025:20278-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
helm.sh/helm/v3
Go
 before 3.14.2
3.14.2
cert-manager
Azure Linux:2
 before 1.11.2-10
1.11.2-10
cert-manager
Azure Linux:3
 before 1.12.13-1
1.12.13-1
helm
Azure Linux:3
 before 3.13.2-3
3.13.2-3
helm
Bitnami
 before 3.14.2
3.14.2
helm
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP5
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
helm
openSUSE:Leap Micro 5.5
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 3.16.3-150000.1.38.1
3.16.3-150000.1.38.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP5
From an advisory covering 2 CVEs
 before 3.13.3-150000.1.32.1
3.13.3-150000.1.32.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 2 CVEs
 before 3.13.3-150000.1.32.1
3.13.3-150000.1.32.1
helm
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 3.13.3-150000.1.32.1
3.13.3-150000.1.32.1
helm
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 3.17.2-1.1
3.17.2-1.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 3.17.2-slfo.1.1_1.1
3.17.2-slfo.1.1_1.1
helm
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.9.1-11.9.2-1
 None known
helm
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.2-12.8.5-12.8.6-12.8.7-12.8.8-1
 None known
helm
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.2-13.5.0-33.6.0-1
 None known
helm
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.7.0-23.8.0-1
 None known
helm
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.8.4-1
 None known
helm
Ubuntu:25.10
 All versions, plus listed versions
3.8.4-24.0.3-1
 None known
helm
Ubuntu:26.10
 All versions, plus listed versions
4.0.6-34.0.7-1
 None known
helm
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.0.3-14.0.6-14.0.6-24.0.6-3
 None known
helm
openSUSE:Tumbleweed
 before 3.14.2-1.1
3.14.2-1.1
cmctl
openSUSE:Tumbleweed
 before 1.14.4-1.1
1.14.4-1.1
k9s
openSUSE:Tumbleweed
 before 0.32.4-2.1
0.32.4-2.1
helm3
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
 before 3.19.2-1.1
3.19.2-1.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-26147 is a high vulnerability (CVSS 7.5) in Helm, published February 21, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in helm.sh/helm/v3 3.14.2.

References

Show 31 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open