CVE-2019-25210 Information disclosure in n/a
Helm CLI exposes secret values in output when using the --dry-run flag, potentially leaking sensitive data in CI/CD logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25210?
CVE-2019-25210 is a critical vulnerability in n/a, published on 3 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.
Weakness: CWE-200
Which versions are affected by CVE-2019-25210?
It affects 1 product.
Products include Helm Helm.
How do I fix CVE-2019-25210?
No fix published yet.
Is CVE-2019-25210 being exploited?
There is no known exploitation of CVE-2019-25210 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
- CVE-2026-35204 Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
Sources
Also known as CLEANSTART-2026-HT81402, MINI-6962-26wg-4xwc, MINI-f4jp-29q5-wrwm, MINI-fx69-4wcq-4mmq, MINI-fxqv-g53h-979x, MINI-jw83-wc62-2w9j and 1 more.