Helm: The `lookup` template function discloses in-cluster resources, including Secrets, to a chart author

Impact

The lookup template function discloses in-cluster resources, including Secrets, to a chart author

Who can reach it

Anyone who can get an operator to install their chart

What to do

Upgrade Helm; review third-party charts before install

References

Related entries

• Helm: Crafted Chart.yaml plus a symlinked Chart.lock gives local code execution when dependencies are updatedCVE-2025-53547 · HelmHigh
• Helm: Crafted plugin writes its contents to an arbitrary filesystem location on install or updateCVE-2026-35204 · HelmHigh
• Helm: Helm installs plugins with no provenance file even when signature verification is requiredCVE-2026-35205 · HelmHigh
• Helm: Uninitialized variable panic parsing index and plugin YAMLCVE-2024-26147 · HelmHigh
• Helm: Helm repository credentials leaked to a redirected third-party hostCVE-2021-32690 · HelmMedium
• Helm: Path traversal in `helm fetch --untar` writes outside the target directoryCVE-2019-1000008 · HelmMedium