CVE-2020-11013

Public Exploit
lookup Function Information Discolosure in Helm

Description

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0

Category

8.5
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.27%
Third-Party Advisory github.com Third-Party Advisory github.com
Affected: helm Helm
Published at:
Updated at:

References

Link Tags
https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8 third party advisory exploit
https://github.com/helm/helm/releases/tag/v3.2.0 third party advisory release notes

Frequently Asked Questions

What is the severity of CVE-2020-11013?
CVE-2020-11013 has been scored as a high severity vulnerability.
How to fix CVE-2020-11013?
To fix CVE-2020-11013, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-11013 being actively exploited in the wild?
It is possible that CVE-2020-11013 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-11013?
CVE-2020-11013 affects helm Helm.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.