PT-2026-85064

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-82955

In the unreleased development version of Eclipse aeriOS , the KrakenD instance within the API Gateway component had the disable_jwk_security parameter hard-coded to true with no Helm chart override. This disabled TLS certificate verification when KrakenD fetched the JWKS used for bearer token val...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

PT-2026-85169

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11668-1 helm-4.2.4-1.1 on GA media

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

CLEANSTART-2026-QF24401 Security fixes in helm 4.2.4-r1

Package helm version 4.2.4-r1 fixes 1 vulnerabilities: CVE-2026-50163...

CLEANSTART-2026-DI31135 Security fixes in helm-fips 3.21.4-r0

Package helm-fips version 3.21.4-r0 fixes 10 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CLEANSTART-2026-UF35179 Security fixes in helm-fips 4.2.4-r0

Package helm-fips version 4.2.4-r0 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

Security update for helm

This update for helm fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276510. CVE-2026-63308: processing zero-length byte slices in...

SUSE-SU-2026:3882-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276510. - CVE-2026-63308: processing zero-length byte slices in...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: cilium, kubescape, k9s, telegraf, flux-source-controller, k3s, spire-server, skaffold, flux-notification-controller, helm, kubernetes-dashboard, flux, snyk-cli, loki, prometheus-operator, containerd, flux-image-automation-controller, argocd-image-updater, external-dn...

OPENSUSE-SU-2026:11575-1 helm-4.2.4-1.1 on GA media

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-63308

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cilium, kubescape, kwok, cluster-api-provider-vsphere, telegraf, cert-manager-webhook-pdns, gatekeeper, kube-rbac-proxy, k3s, cluster-api-ipam-provider-in-cluster, openbao, kuma, flux-notification-controller, kubernetes-csi-external-health-monitor, rke2-cloud-provide...

CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-76229

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76232

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to...

CVE-2024-58376

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2026-76232

Renovate's helmv3 manager appends the unsanitized repository parameter to helm registry login commands. An attacker with repository write access can craft a malicious Chart.yaml to inject arbitrary commands, executing them on the Renovate host. CVSS 3.1 scores 6.7 (MEDIUM) with HIGH impact across...

CVE-2026-76232 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to...