CVE-2026-66016
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
Risk Assessment
Exposure of TLS private keys may allow an attacker to impersonate services or intercept encrypted traffic.
Recommendation
It is recommended to ensure TLS private keys are not included in manifests and restrict access to rendered files.
Other vulnerabilities in Helm
See all- CVE-2026-63308Medium
A denial of service vulnerability in Helm through version 4.2.3 (fixed in commit ba6c9a2) causes an index out of range panic in the Files.Lines template helper in pkg/engine/files.go. Attackers can include empty files in Helm charts, leading to deterministic render failures during template, install, upgrade, lint, and SDK Engine.Render operations.
- CVE-2026-35205High
Helm versions 4.0.0 through 4.1.3 install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in version 4.1.4.
- CVE-2026-35204High
A vulnerability in Helm from version 4.0.0 to 4.1.3 allows writing plugin contents to arbitrary filesystem locations via a crafted 'version' field in plugin.yaml containing '/../' (dot-dot) path separators.
Original NVD description (English source)
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS