CVE-2020-11013 lookup Function Information Discolosure in Helm
A malicious Helm chart can leak cluster information via the lookup function during template rendering, bypassing the expected offline behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11013?
CVE-2020-11013 is a high-severity vulnerability in Helm, published on 24 Apr 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0
Weakness: CWE-200
Which versions are affected by CVE-2020-11013?
3 open source packages ship an affected version, including helm.sh/helm/v3 and helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm.sh/helm/v3 Go | From 3.0.0 | 3.1.3 |
helm.sh/helm/v3 Go | From 3.0.0 | 3.1.3 |
helm Bitnami | From 3.1.0 | 3.2.0 |
Products include Helm Helm.
How do I fix CVE-2020-11013?
Upgrade helm.sh/helm/v3 to 3.1.3 or later.
Is CVE-2020-11013 being exploited?
There is no known exploitation of CVE-2020-11013 in the wild and no public exploit code.
Other vulnerabilities in Helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2026-35204 Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
Sources
Also known as BIT-helm-2020-11013, GHSA-q8q8-93cv-v6h8, UBUNTU-CVE-2020-11013.