Skip to content
Threat Feed
Subscribe

Tag

Helm

3 briefs RSS
critical advisory

Rancher Fleet Helm Impersonation Bypass Vulnerability

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Fleet +5 rancher helm kubernetes impersonation privilege-escalation cve-2026-41050
2r 1t
high advisory

Helm Plugin Path Traversal Vulnerability

A path traversal vulnerability in Helm versions 4.0.0 to 4.1.3 allows a malicious plugin to write files to arbitrary locations on the filesystem, leading to potential system compromise.

PoC Helm path-traversal vulnerability plugin kubernetes
2r 1t 1c 8i updated
high advisory

Helm Plugin Verification Bypass Vulnerability

Helm versions 4.0.0 through 4.1.3 fail to enforce plugin signature verification when the .prov file is missing, allowing installation of unsigned plugins and potentially leading to arbitrary code execution.

Helm kubernetes plugin signature-bypass cve-2026-35205
2r 2t 1c