1512 matches found
CVE-2026-67349
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
EUVD-2026-51152
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CVE-2026-67349
OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CLEANSTART-2026-IK55843 Security fixes in helm 4.1.4-r2
Package helm version 4.1.4-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
CLEANSTART-2026-QV76866 Security fixes in helm 3.19.5-r0
Package helm version 3.19.5-r0 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2025-68121, CVE-2025-61732, CVE-2026-27139...
CLEANSTART-2026-UT23053 Security fixes in helm-operator 1.42.2-r3
Package helm-operator version 1.42.2-r3 fixes 4 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-39822, CVE-2026-42505...
CLEANSTART-2026-QP97203 Security fixes in helm 4.0.5-r2
Package helm version 4.0.5-r2 fixes 43 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27143, CVE-2026-27144...
CLEANSTART-2026-UQ50946 Security fixes in helm 4.1.3-r0
Package helm version 4.1.3-r0 fixes 21 vulnerabilities: CVE-2026-42501, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817...
CLEANSTART-2026-AU93241 Security fixes in helm-operator 1.42.1-r0
Package helm-operator version 1.42.1-r0 fixes 30 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-39820, ghsa-p77j-4mvh-x3m3, CVE-2026-27143, CVE-2026-42499...
CLEANSTART-2026-MR47325 Security fixes in helm 3.20.2-r0
Package helm version 3.20.2-r0 fixes 1 vulnerabilities: CVE-2026-33186...
CLEANSTART-2026-QV10539 Security fixes in helm 4.1.4-r0
Package helm version 4.1.4-r0 fixes 4 vulnerabilities: CVE-2026-50151, CVE-2026-50162, ghsa-vh4v-2xq2-g5cg, CVE-2026-48978...
CLEANSTART-2026-CY22332 Security fixes in helm-operator 1.42.2-r1
Package helm-operator version 1.42.2-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...
SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:3342-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3342-1 advisory. Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for...
Security update for helm
This update for helm fixes the following issues: Update to version 3.21.3. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. CVE-2026-56852: golang.org/x/text/unicode/norm: handling input...
SUSE-SU-2026:3342-1 Security update for helm
This update for helm fixes the following issues: Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling inp...
SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:22855-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22855-1 advisory. This update for helm fixes the following issues - Update to version 3.21.3 - CVE-2026-39821: golang.org/x/net/idna: failure to...