VDB
RHSA-2026:67540
RHSA-2026:67540
PUBLISHED
CVSS 7.699999809265137 HIGH
A command injection vulnerability has been identified in Helm, a package manager for Kubernetes. An attacker can craft a malicious Chart.yaml file with specially linked dependencies in a Chart.lock file. If the Chart.lock file is a symbolic link to an executable file, such as a shell script, and a user attempts to update the dependencies, the crafted content is written to the symlinked file and executed. This can lead to local code execution on the system. This issue has been patched in Helm version 3.18.4, and users should update to this version to mitigate the risk.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/metrics-collector-rhel9@sha256:a66de955f596f58a590d95d074d9d9fe6862afc6e357a55a8e718330bdbfa2fa_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:dcd6a1ea2203ef37c4f6ddb71a3f3c2249dfb51624e460de0deb5c561ce71fe6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-siteconfig-rhel9@sha256:e6d2b7d0a424b9aa782c8aba6018d32eca7c43c73cf9efa65ac30c2141c03c32_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-siteconfig-rhel9@sha256:b4ddd726f3a4489439166e9dc503ae9135349b07a188cf407411600efc5a7aee_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-api-rhel9@sha256:1ca939c798c63bcff68549b793c86f5f1adeb9448b0aac8ca457f4971934ac7f_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-indexer-rhel9@sha256:3ad171c336144fb3a649c88493cdf3fc2ef8523c56ae8f8f650fa09fc66a6db9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/config-policy-controller-rhel9@sha256:66729bb09010747ddafcb821ffd15046c49d641d27fc30244bab3913b0cce589_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:1e70ea15b1c487865e05996606dd7d1df39fc328d62045e45f0adcef50414b2e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9@sha256:4506af5fc8d5e2f3065ee1914a95ff86a95798d89cf70691a81dc0ad13ce31b6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9@sha256:51aa11772954b70f9ff17d992f2027205f659256ffd5d2e375893472ba12d18e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:204d7960e6e25bc3c00cb3fcc19b9c7d3617308a01f0a627d90576b5ee743409_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:ced054fdaafa4f64b9694d9d735e84888e285fd375020b03d20303eb36f4fc9d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/search-collector-rhel9@sha256:67bb4db1d2224859ca9f4e3a4b5b210ef64e782e4b4a6229d4533b0bc8154e96_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/klusterlet-addon-controller-rhel9@sha256:3ced8906eabc22ca52be173d2e5f9e55f04f617e9ebd35e1a9fb85249cf597cc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:76615639d0c1644d6ab03d91bb9c5d0017696a138a1bff7def3d9027f254c8e7_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/config-policy-controller-rhel9@sha256:c7ccc8c80bf1d7b4d694375ea354c5cf8731226e548b52795c7b699dc3f91a6a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:f34c6a8510b6420b94f02590a572854d4dfc65edc2f9a50b205e1d1538d7258d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:a1193d74174245438f29f6c959da5b036b47ff1b7912bed84b39e75d0308e8ed_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:bbbc90d508edecaf284b09fd054f300ac3490f106cc45368c3ab89acee56a2e1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
| Red Hat | registry.redhat.io/rhacm2/search-collector-rhel9@sha256:82003912645233eab64aedffc8deab7cdc8b5483e90754a7df6bc3d6c528b93b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 | * |
…and 156 more
Timeline
- Sep 15, 2026 CVE Published
- Sep 23, 2026 CVE Updated
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:67540 advisory
- https://access.redhat.com/security/cve/CVE-2025-53547 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-48586 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-66780 advisory
- https://access.redhat.com/security/cve/CVE-2026-71556 advisory
- https://access.redhat.com/security/cve/CVE-2026-73646 advisory
- https://access.redhat.com/security/cve/CVE-2026-89060 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67540.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2378905 issue
- https://www.cve.org/CVERecord?id=CVE-2025-53547 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-53547 advisory
- https://github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571 advisory
- https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484830 issue
…and 50 more