CVE-2026-75036 Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-75036

Fleet (Rancher's GitOps operator) is vulnerable to DNS-based information disclosure during Helm template preprocessing. The Sprig getHostByName function, evaluated by the Fleet controller, can reach network resources outside the management cluster, allowing a user who can supply bundle content to...

EUVD-2026-70520

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-75036 Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-75036: Server-Side Request Forgery (SSRF)

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

PT-2026-85064

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-82955

In the unreleased development version of Eclipse aeriOS , the KrakenD instance within the API Gateway component had the disable_jwk_security parameter hard-coded to true with no Helm chart override. This disabled TLS certificate verification when KrakenD fetched the JWKS used for bearer token val...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

PT-2026-85169

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11668-1 helm-4.2.4-1.1 on GA media

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

CLEANSTART-2026-DI31135 Security fixes in helm-fips 3.21.4-r0

Package helm-fips version 3.21.4-r0 fixes 10 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CLEANSTART-2026-UF35179 Security fixes in helm-fips 4.2.4-r0

Package helm-fips version 4.2.4-r0 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CLEANSTART-2026-QF24401 Security fixes in helm 4.2.4-r1

Package helm version 4.2.4-r1 fixes 1 vulnerabilities: CVE-2026-50163...

Security update for helm

This update for helm fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276510. CVE-2026-63308: processing zero-length byte slices in...

SUSE-SU-2026:3882-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276510. - CVE-2026-63308: processing zero-length byte slices in...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: rclone, kubernetes, skaffold, flux-image-automation-controller, kubevela, minio, helm, rancher-agent, cilium, nerdctl, sftpgo, gitea, gitness, flux, flux-notification-controller, fscrypt, loki, k9s, chisel, external-dns, aactl, prometheus-operator, containerd, kyvern...

PT-2026-80623

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11575-1 helm-4.2.4-1.1 on GA media

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:3661-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3661-1 advisory. This update for helm rebuilds it against the current go security release. Tenable has extracted the preceding description block directly fro...

CVE-2026-63308

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...