Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the helm.repo process when the helmRepoURLRegex field is not set on a GitRepo resource. An attacker with git push access to a monitored repository can cause the system to forward Helm authentication...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the helm.repo process when the helmRepoURLRegex field is not set on a GitRepo resource. An attacker with git push access to a monitored repository can cause the system to forward Helm authentication...

GHSA-HX4V-CXPF-VH8M Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Impact A vulnerability has been identified in Fleet when the helmRepoURLRegex field isn't set on a GitRepo resource. Fleet's bundle reader forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo field of a fleet.yaml file. An attacker with git push access to a...

PT-2026-55133

Impact A vulnerability has been identified in Fleet when the helmRepoURLRegex field isn't set on a GitRepo resource. Fleet's bundle reader forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo field of a fleet.yaml file. An attacker with git push access to a...

PT-2026-55201

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.15.2 SUSE Rancher Fleet versions prior to 0.14.6 SUSE Rancher Fleet versions prior to 0.13.11 SUSE Rancher Fleet versions prior to 0.12.15 Description Missing validation of valuesFrom references in the He...

PT-2026-54762

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 0.12.15 Fleet versions prior to 0.13.11 Fleet versions prior to 0.14.6 Fleet versions prior to 0.15.2 Description Fleet forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo field of a...

SUSE-SU-2026:22455-1 Security update for helm

This update for helm fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. Changes for helm: - update to 3.21.2: choredeps: bump the k8s-io group with 2 updates...

Security update for helm (important)

openSUSE security update: security update for helm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20994-1 Rating: important References: bsc1266598 Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE : 7.4...

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

ResolutionFixed in v3.1.0, released 2026-05-25. The fix was merged in PR 95 at commit 1c7d3f9. The fix changes the default HTTP bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS exposure unless OAuth is enabled, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed...

SUSE-SU-2026:22432-1 Security update for helm

This update for helm fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. Changes for helm: - update to 3.21.2: choredeps: bump the k8s-io group with 2 updates...

PT-2026-53492

Resolution Fixed in v3.1.0, released 2026-05-25. The fix was merged in PR 95 at commit 1c7d3f9. The fix changes the default HTTP bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS exposure unless OAuth is enabled, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed...

SUSE CVE-2026-54448

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to...

GHSA-73CV-556C-W3G6 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Resolution Fixed in v3.1.0, released 2026-05-25. The fix was merged in PR 95 at commit 1c7d3f9. The fix changes the default HTTP bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS exposure unless OAuth is enabled, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: drone, minio, skaffold, external-dns, omnictl-multiarch-fips, cloud-provider-aws, etcd-fips, traefik, aactl, chisel-fips, tekton-pipelines, trivy-operator, keda-fips, nerdctl, mattermost-fips, calico-fips, frankenphp-8.3, cilium, osv-scanner, vault, frankenphp-8.4,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: melange, crossplane-provider-azure-storage, k9s, falco-no-driver, zot, glab, podman, docker, loki, wal-g, hcloud, trivy-operator, step, skaffold, prometheus, prometheus-operator, rancher, witness, act, gptscript, pulumi, slsa-verifier, step-issuer, eksctl, age,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, gitlab-kas, k9s, falco-no-driver, zot, flux-source-controller, cloud-provider-aws, cert-manager, kine, loki, external-secrets-operator, cilium-cli, helm, osv-scanner, kubernetes-dashboard, nerdctl, kubernetes, opentelemetry-collector, aactl,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: buildah, minio, kots, snyk-cli, gitlab-kas, falco-no-driver, zot, podman, cloud-provider-aws, cert-manager, kine, loki, external-secrets-operator, cilium-cli, helm, kubernetes-dashboard, nerdctl, kubernetes, opentelemetry-collector, aactl, cilium, flux, prometheus,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: datadog-agent, minio, kots, snyk-cli, argo-cd, gomplate, melange, syft, gitlab-kas, terragrunt, k9s, falco-no-driver, zot, flux-source-controller, podman, cloud-provider-aws, cert-manager, kine, loki, chezmoi, external-secrets-operator, cilium-cli, helm, osv-scanner,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: minio, kots, docker-machine-driver-harvester, snyk-cli, gitlab-kas, k9s, falco-no-driver, zot, flux-source-controller, cloud-provider-aws, cert-manager, kine, loki, external-secrets-operator, cilium-cli, helm, osv-scanner, kubernetes-dashboard, nerdctl, kubernetes,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: melange, k9s, falco-no-driver, zot, podman, loki, trivy-operator, step, skaffold, prometheus, prometheus-operator, rancher, witness, act, gptscript, pulumi, step-issuer, argo-cd, gomplate, terragrunt, syft, cloud-provider-aws, cilium-cli, helm, kubernetes,...