Multiple Vulnerabilities in Helm Allow Arbitrary Code Execution
Summary
CERT-Bund published security advisory WID-SEC-2026-1048 disclosing multiple vulnerabilities in Helm (Kubernetes package manager) with a CVSS Base Score of 8.6 (high). Affected versions include helm <4.1.4 and helm <3.20.2. An attacker can exploit these vulnerabilities to manipulate files, bypass security measures, and potentially execute arbitrary code.
What changed
CERT-Bund disclosed multiple high-severity vulnerabilities in the Helm Kubernetes package manager affecting versions below 4.1.4 and 3.20.2. The vulnerabilities have a CVSS Base Score of 8.6, allowing attackers to manipulate files, bypass security measures, and potentially execute arbitrary code.
Organizations running Helm in Kubernetes environments should immediately upgrade to a patched version and apply available mitigations to prevent exploitation. Security teams should audit deployments and monitor for suspicious activity.
What to do next
- Upgrade Helm to version 4.1.4 (for Helm 4.x) or 3.20.2 (for Helm 3.x)
- Review Kubernetes deployments for indicators of compromise
- Monitor for available patches and security updates
Archived snapshot
Apr 10, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1048] helm: Mehrere Schwachstellen CVSS Base Score 8.6 (hoch) CVSS Temporal Score 7.5 (hoch) Remoteangriff nein Datum 09.04.2026 Stand 10.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
Produktbeschreibung
Helm ist ein Open-Source-Paketmanager für Kubernetes, der die Bereitstellung und Verwaltung von Anwendungen vereinfacht.
Produkte
09.04.2026
- Open Source helm <4.1.4
- Open Source helm <3.20.2
Angriff
Angriff
Ein Angreifer kann mehrere Schwachstellen in helm ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und potenziell um beliebigen Code auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.