CVE-2021-32690 Repository credentials passed to alternate domain
Helm leaks repository credentials to alternate domains when installing charts, exposing sensitive authentication data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32690?
CVE-2021-32690 is a medium-severity vulnerability in helm, published on 16 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.
Weakness: CWE-200
Which versions are affected by CVE-2021-32690?
6 open source packages ship an affected version, including helm.sh/helm/v3 and helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm.sh/helm/v3 Go | All versions | 3.6.1 |
helm.sh/helm/v3 Go | All versions | 3.6.1 |
helm.sh/helm/v3 Go | All versions | 3.6.1 |
helm.sh/helm/v3 Go | All versions | 3.6.1 |
helm.sh/helm/v3 Go | All versions | 3.6.1 |
helm Bitnami | All versions | 3.6.1 |
Products include Helm Helm.
How do I fix CVE-2021-32690?
Upgrade helm.sh/helm/v3 to 3.6.1 or later.
Is CVE-2021-32690 being exploited?
There is no known exploitation of CVE-2021-32690 in the wild and no public exploit code.
Other vulnerabilities in helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
Sources
Also known as AZL-6471, BIT-helm-2021-32690, GHSA-56hp-xqp3-w2jf, GHSA-7jr6-prv4-5wf5, GO-2022-0384.