Patchfirst
Patchfirst
CVE-2020-11013 High · 8.5 EPSS 1.4%

lookup Function Information Discolosure in Helm

helm · Helm

Official description · CVE.org

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0

Breakdown
20.5 / 100
Exploited
Not confirmed
Reports
0
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

Disclosed on 24 Apr 2020. No public exploit code or confirmed exploitation is recorded.

See the family tree

8 related vulnerabilities in the same code over 5 years. The latest fix listed for helm.sh/helm/v3 is 3.3.2.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2020-11013lookup Function Information Discolosure in Helm24 Apr 2020
  2. same family
    CVE-2021-21303Injection attack in Helm5 Feb 2021
  3. relatedHigh

    Why these are linked:

    • Fixed one release later3.5.2 → 3.6.1 (helm.sh/helm/v3)
    • Same code patched: chartrepo.go (machine-matched)Functions: DownloadIndexFilecommit 6ce9ba6commit 61d8e8c
    CVE-2021-32690Repository credentials passed to alternate domain16 Jun 2021
  4. same family
    CVE-2022-23525Helm vulnerable to Denial of service via NULL Pointer…15 Dec 2022
  5. Next fix in the same packageLow

    Why these are linked:

    • Fixed one release later3.10.3 → 3.11.1 (helm.sh/helm/v3)
    CVE-2023-25165getHostByName Function Information Disclosure8 Feb 2023
  6. Next fix in the same packageLow

    Why these are linked:

    • Fixed one release later3.11.1 → 3.14.1 (helm.sh/helm/v3)
    CVE-2024-25620Dependency management path traversal in helm14 Feb 2024
  7. Next fix in the same packageLow

    Why these are linked:

    • Fixed one release later3.14.1 → 3.14.2 (helm.sh/helm/v3)
    CVE-2024-26147Helm's Missing YAML Content Leads To Panic21 Feb 2024
  8. relatedMedium

    Why these are linked:

    CVE-2025-55198Helm May Panic Due To Incorrect YAML Content13 Aug 2025

Fixes in helm.sh/helm/v3Go package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3.1.0CVE-2020-791916 Mar 2020
  2. 3.1.3CVE-2020-1101324 Apr 2020
  3. 3.2.4CVE-2020-405316 Jun 2020
  4. 3.3.2CVE-2020-1518417 Sep 2020
  5. 3.3.2CVE-2020-1518517 Sep 2020Latest listed

techniques

1 , grouped by in kill-chain order 1

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 149 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-11013 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: helm.sh/helm/v3.

Gohelm.sh/helm/v3GHSA-q8q8-93cv-v6h8

Upgrade to 3.1.3 or later

Gogo get helm.sh/helm/v3@v3.1.3

The first fix for CVE-2020-11013. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
3.0.0 up to 3.1.33.1.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8

x_refsource_MISC 1

github.com/helm/helm/releases/tag/v3.2.0
↑ ↓ chooseEnter openEsc close