Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Withdrawn — this advisory has been retracted
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

Duplicate Advisory: Helm passes repository credentials to alternate domainGHSA-7jr6-prv4-5wf5

MEDIUMFix: helm/helm@61d8e8c

GHSA-7jr6-prv4-5wf5 is a medium-severity (CVSS 6.8) Information Exposure vulnerability in helm.sh/helm/v3. A fix is available for helm.sh/helm/v3 — see the affected versions and patch details below.

Also known asBIT-helm-2021-32690CVE-2021-32690GHSA-56hp-xqp3-w2jfGO-2022-0384
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs72th percentile — riskier than 72% of all scored CVEsHighest risk
0.00%0.64%1.29%1.93%0.4%1.4%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-7jr6-prv4-5wf5 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐹helm.sh/helm/v3

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-56hp-xqp3-w2jf. This link is maintained to preserve external references.

Original Description

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the index.yaml file for that repository, one may look for another domain in the urls list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gohelm.sh/helm/v3all versions3.6.1go get helm.sh/helm/v3@v3.6.1

Affected Products

1 product · 1 configurations
Application
helmhelm
< 3.6.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for helm.sh/helm/v3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update helm.sh/helm/v3 to 3.6.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7jr6-prv4-5wf5 is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

Red Hat Advanced Cluster Management for Kubernetes: In Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are using helm chart provided by the installer, so components are not using untrusted charts except in the application-lifecycle area. For this reason we marked the impact as low.…

ProductFixed inAdvisory
Red Hat OpenShift Container Platform 4.9openshift4/ose-console:v4.9.0-202110130449.p0.git.8c077e4.assembly.rc.8RHSA-2021:3759
RHACS-3.67-RHEL-8advanced-cluster-security/rhacs-rhel8-operator:3.67.0-3RHSA-2021:4902
RHEL-8 based Middleware Containersweb-terminal-tech-preview/web-terminal-exec-rhel8:1.3-9RHEA-2021:3139

Frequently Asked Questions

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-56hp-xqp3-w2jf. This link is maintained to preserve external references. ## Original Description Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed creden
O3 Security · Impact-Aware SCA

Is GHSA-7jr6-prv4-5wf5 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Duplicate Advisory: Helm passes repository credentials to…