Arbitrary Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Arbitrary Command Injection due to the improper sanitazation of user-supplied chart name in the helmRepositoryArgs function of kustomize manager. An attacker can execute arbitrary commands on the host...

GHSA-XV56-3WQ5-9997 Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

Summary The user-provided chart name in the kustomize manager is appended to the helm pull --untar command without proper sanitization. Details Adversaries can provide a maliciously crafted kustomization.yaml in conjunction with a Helm repo's index.yaml file to trick Renovate to execute arbitrary...

Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

Summary The user-provided chart name in the kustomize manager is appended to the helm pull --untar command without proper sanitization. Details Adversaries can provide a maliciously crafted kustomization.yaml in conjunction with a Helm repo's index.yaml file to trick Renovate to execute arbitrary...

PT-2026-78414

Name of the Vulnerable Software and Affected Versions Renovate versions 31.51.0 through 40.32.0 Description A command injection issue exists in the helmv3 manager. The repository parameter is appended to helm registry login commands without proper sanitization. Attackers with write access to the...

CVE-2025-61916

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into spinnaker pipelines vi...

CVE-2025-61916: Improper Input Validation

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into spinnaker pipelines vi...

Kasten Prometheus Export via remote_write

Purpose Kasten now supports exporting metrics from the embedded Prometheus to external backends using Prometheus's remotewrite capability. This feature supports the collection, aggregation, and visualization of cluster and multi-cluster metrics in monitoring tools like Grafana Cloud and Datadog...

The configuration “config.enableHelm: true” of the user interface of the Kubernetes cluster management software “Headlamp” allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the config.enableHelm: true configuration in the user interface of the Kubernetes cluster management software’s command-line tool is related to the disclosure of information through caching during the processing of the /clusters/main/helm/releases/list directory. Exploiting...

📄 Headlamp 0.38.0 Unauthenticated Cached Credentials Access

Proof of concept exploit for a flaw in Headlamp Kubernetes dashboard versions 0.38.0 and below that allows unauthenticated users to access sensitive Helm release data, including secrets, tokens, and passwords, due to improper server-side caching...

openSUSE Security Advisory (SUSE-SU-2025:4437-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

📄 Headlamp 0.38.0 Credential Reuse

A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with config.enableHelm: tru...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2025:4437-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:4437-1 advisory. This update for helm rebuilds it against current GO to fix security issues in go-stdlib. Tenable has extracted the preceding...

Credential caching in Headlamp with Helm enabled

Original tracking issue: https://github.com/kubernetes-sigs/headlamp/issues/4282 CVSS Rating: High 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Description of vulnerability A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse...

Security update for helm

This update for helm rebuilds it against current GO to fix security issues in go-stdlib. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE...

SUSE-SU-2025:4437-1 Security update for helm

This update for helm rebuilds it against current GO to fix security issues in go-stdlib...

PT-2025-52206

Name of the Vulnerable Software and Affected Versions Headlamp versions prior to 0.39.0 Description A configuration issue with config.enableHelm: true in the Headlamp user interface for Kubernetes cluster management leads to information disclosure through caching when processing the...

PT-2025-54913

This update for helm rebuilds it against current GO to fix security issues in go-stdlib...

SUSE-SU-2025:21221-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.19.1 bsc1251649, CVE-2025-58190, bsc1251442, CVE-2025-47911: choredeps: bump github.com/containerd/containerd from 1.7.28 to 1.7.29 jsonschema: warn and ignore unresolved URN $ref to match v3.18.4 Avoid "panic: interface...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, polaris, kubernetes-dashboard-auth, octo-sts, php-fpmexporter, task, splunk-otel-collector, snyk-cli, harbor-scanner-trivy, postgres-operator, seaweedfs, spqr, helm-push, terraform-mcp-server, nri-jmx,...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, polaris, kubernetes-dashboard-auth, octo-sts, php-fpmexporter, task, splunk-otel-collector, snyk-cli, harbor-scanner-trivy, postgres-operator, seaweedfs, spqr, helm-push, terraform-mcp-server, nri-jmx,...