CVE-2026-45132: Improper Control of Generation of Code

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow generate-schema.yaml exposes sensitive credentials Personal Access Token and SSH signing key to fork-controlled code due to unsafe checkout and credential handling practices. Th...

SUSE-SU-2026:22001-1 Security update for helm

This update for helm fixes the following issues Security issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled...

SUSE-SU-2026:21952-1 Security update for helm

This update for helm fixes the following issues Security issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled...

OPENSUSE-SU-2026:20860-1 Security update for helm

This update for helm fixes the following issues Security issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled...

helm-4.2.0-3.1 on GA media (moderate)

helm-4.2.0-3.1 on GA media Announcement ID: openSUSE-SU-2026:10876-1 Rating: moderate Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N...

SUSE-SU-2026:21915-1 Security update for helm

This update for helm fixes the following issues - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration...

OPENSUSE-SU-2026:10876-1 helm-4.2.0-3.1 on GA media

These are all security issues fixed in the helm-4.2.0-3.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the package manager for Kubernetes Helm, related to incorrect path name restrictions for restricted access directories, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the package manager for Kubernetes Helm is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...

The vulnerability of the package manager for Kubernetes Helm, related to the use of an unprotected alternative channel, allows a attacker to expose protected information.

The vulnerability of the package manager for Kubernetes Helm is related to the use of an unprotected alternative channel. Exploiting this vulnerability could allow a attacker to expose protected information...

SUSE SLES15 Security Update : helm (SUSE-SU-2026:2049-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2049-1 advisory. This update for helm fixes the following issues Security issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2...

Security update for helm

This update for helm fixes the following issues Security issues: CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled...

SUSE-SU-2026:2049-1 Security update for helm

This update for helm fixes the following issues Security issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled...

The vulnerability of the package manager for Kubernetes Helm, related to an incorrect path name limitation for the restricted access directory, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the package manager for Kubernetes Helm is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: buildkitd, kargo, helm-push, gatekeeper, k8ssandra-client, spegel, cluster-api-helm-controller, trivy, grype, rancher-helm, zarf, gogatekeeper, kubevela, rancher, dagger, zot, helm-set-status, kaniko, kube-arangodb, datadog-agent, k9s, opa, scorecard, consul-k8s,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: buildkitd, kargo, helm-push, gatekeeper, k8ssandra-client, spegel, cluster-api-helm-controller, trivy, grype, rancher-helm, zarf, gogatekeeper, kubevela, rancher, dagger, zot, helm-set-status, kaniko, kube-arangodb, datadog-agent, k9s, opa, scorecard, consul-k8s,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: envoy-gateway, kubescape-operator-fips, gatekeeper, trivy-operator-fips, teleport, kube-arangodb-fips, kubescape, xeol, chaos-mesh-fips, chartmuseum, datadog-agent-fips, kube-mgmt-fips, kubescape-operator, xeol-fips, helm-exporter-fips, grype-db, docker-compose-fips,...

OPENSUSE-SU-2026:10823-1 helm-4.2.0-2.1 on GA media

These are all security issues fixed in the helm-4.2.0-2.1 package on the GA media of openSUSE Tumbleweed...

helm-4.2.0-1.1 on GA media (moderate)

helm-4.2.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10814-1 Rating: moderate Cross-References: CVE-2026-41888 CVSS scores: CVE-2026-41888 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2026-41888 SUSE : 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N...

OPENSUSE-SU-2026:10814-1 helm-4.2.0-1.1 on GA media

These are all security issues fixed in the helm-4.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

Improper Authorization

Fleet is vulnerable to Improper Authorization. The vulnerability is due to incomplete application of ServiceAccount impersonation in certain Helm deployer code paths, which allows an attacker with git push access to read secrets from arbitrary namespaces on downstream clusters...