VDB
RHSA-2026%3A30651
RHSA-2026%3A30651
PUBLISHED
CVSS 4.400000095367432 MEDIUM
A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a specially crafted Chart to the `helm pull --untar` command. This would cause the Chart's contents to be written to an unintended directory, potentially overwriting existing files or placing malicious files in an accessible location, leading to data integrity and availability issues.
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:022bd56f0ed4905f878b97137f0ba22491c7eaa2e6d055f691c9fdc191b1242c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-prometheus-rhel9@sha256:1178415df27e4965614038edc52decfbd86aa9760cf5c17064da7ce26e418d10_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:fe05d4ccad37dc77838d9ca2abac46fea374c1082e1cbbdb70e7f690f541bb61_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:23bce2847e65215b8e9ec64b7c959a6d10ddb8e8196496780a9a49af34cc223f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/prometheus-alertmanager-rhel9@sha256:974489ed8c8264989560c141db233e5cbb153d4a2be2b855cd2d093426dcc62a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-indexer-rhel9@sha256:c23d12ae106e42bbb07ba9d395210255602f9a3c3509be166a78490a1b5d680b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:2e9da0c72a8e750cf7d7e12e01686a97eddf77ed16d3203ad80b295e4e81ccf9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/search-collector-rhel9@sha256:789f52a712c7411d528312031822d99081089bcf7e86558a5554e4da9d507d0c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-api-rhel9@sha256:208e3a53a542d974fa2db37209606494e96faa405a96a1e9cb0e5ef7029beb74_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/cluster-backup-rhel9-operator@sha256:561bf14e1e867ff8fe681016fe3b094a8f8912289f3ee4be47019aead8c3cbfe_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:9be3d9427b84d64f428c4e9f65ad6e09bcc5d95dd03272ae648f0dae8722f55e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/observatorium-rhel9@sha256:594752a982b71f3169feb2adf5b34f45d3b28fbe853c1856f756dfe197e73985_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:dd99134a27d15d0aa4a870f182563be3b86cfd5f55d560c8374053cfcfec5af3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/console-rhel9@sha256:af0e97f359be9b5806c41187db360455a35cf694cd7811e68d46a22e7d570c0d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/config-policy-controller-rhel9@sha256:6310652fb60265cbb187a675d5ebfc1b79f8d83a54700b098f7f488ba4170b64_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/submariner-addon-rhel9@sha256:c69d321ce3673b06d11e98f7616bbf5af6d08f769044e5743ca86509cac08f7a_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/kube-state-metrics-rhel9@sha256:2a1f43a068ecf8f7712db5820e3b3f7ca98f2bd59f067614c0f3c715f8fe59df_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:188aa1452e1727a3722729d73c560969cd02bfa29601eba3bca65945027c5fbf_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9@sha256:2d407ee93eac1c360bd12618b32f4f3b251179bf48226e471dd6d8f4bd6673ee_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9@sha256:787b044060560ddfaade07adbaffdb23d28845eb454a7ee89f2cf972d15c17ce_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
…and 156 more
Timeline
- Jun 28, 2026 CVE Published
- Jun 30, 2026 CVE Updated
- Jun 30, 2026 Distribution Patch
- Jun 30, 2026 Distribution Patch
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
- Jun 30, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2026-46385 advisory
- https://access.redhat.com/errata/RHSA-2026:30651 advisory
- https://access.redhat.com/security/cve/CVE-2026-35206 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-43869 advisory
- https://access.redhat.com/security/cve/CVE-2026-44486 advisory
- https://access.redhat.com/security/cve/CVE-2026-44487 advisory
- https://access.redhat.com/security/cve/CVE-2026-44488 advisory
- https://access.redhat.com/security/cve/CVE-2026-44492 advisory
- https://access.redhat.com/security/cve/CVE-2026-44494 advisory
- https://access.redhat.com/security/cve/CVE-2026-44495 advisory
- https://access.redhat.com/security/cve/CVE-2026-44496 advisory
- https://access.redhat.com/security/cve/CVE-2026-46384 advisory
- https://access.redhat.com/security/cve/CVE-2026-46595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30651.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2457151 issue
- https://www.cve.org/CVERecord?id=CVE-2026-35206 advisory
…and 66 more