Helm vulnerabilities
4 known CVE vulnerabilities in Helm, translated and rated.
- CVE-2026-66016Medium
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
- CVE-2026-63308Medium
A denial of service vulnerability in Helm through version 4.2.3 (fixed in commit ba6c9a2) causes an index out of range panic in the Files.Lines template helper in pkg/engine/files.go. Attackers can include empty files in Helm charts, leading to deterministic render failures during template, install, upgrade, lint, and SDK Engine.Render operations.
- CVE-2026-35205High
Helm versions 4.0.0 through 4.1.3 install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in version 4.1.4.
- CVE-2026-35204High
A vulnerability in Helm from version 4.0.0 to 4.1.3 allows writing plugin contents to arbitrary filesystem locations via a crafted 'version' field in plugin.yaml containing '/../' (dot-dot) path separators.