Bug 2268201 (CVE-2019-25210) - CVE-2019-25210 helm: shows secrets with --dry-run option in clear text
Summary: CVE-2019-25210 helm: shows secrets with --dry-run option in clear text
Status: NEW
Alias: CVE-2019-25210
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Product Security
QA Contact:
Depends On: 2268202 2268203 2268204
Blocks: 2268206
TreeView+ depends on / blocked
Reported: 2024-03-06 16:04 UTC by ybuenos
Modified: 2024-04-28 19:16 UTC (History)
27 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
A vulnerability was found in Helm that may lead to sensitive information disclosure. When the --dry-run flag is used in Helm 3, it displays values of secrets. Helm 2 just displays the fact that a secret has been created.
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description ybuenos 2024-03-06 16:04:27 UTC
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).


Note You need to log in before you can comment on or make changes to this bug.