VDB
RHSA-2026:67541
RHSA-2026:67541
PUBLISHED
CVSS 7.699999809265137 HIGH
A command injection vulnerability has been identified in Helm, a package manager for Kubernetes. An attacker can craft a malicious Chart.yaml file with specially linked dependencies in a Chart.lock file. If the Chart.lock file is a symbolic link to an executable file, such as a shell script, and a user attempts to update the dependencies, the crafted content is written to the symlinked file and executed. This can lead to local code execution on the system. This issue has been patched in Helm version 3.18.4, and users should update to this version to mitigate the risk.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/multicluster-role-assignment-rhel9@sha256:75e331f9a25c19eeac5def5f3ba57b854975634f2056d5529dab6a7d1d03da6d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-role-assignment-rhel9@sha256:71200842e6101443d6ea358d9abe3fce50f8fe47918ba425e33cb027a3bd8ee5_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/submariner-addon-rhel9@sha256:888f8cec2463a3d2f38bb9e7041363118e394f3b643a3a8565dce921d726bfe4_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/config-policy-controller-rhel9@sha256:9373217b26deec7a839dbe55a4c40da5ba6a6fecb9aec90606ee16f0efec3034_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:cd8e17ab710629d7a954c40bd4dc19c2013320f3287832296939161afa6b0709_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/cert-policy-controller-rhel9@sha256:208d3f24f653ed1709bac303167d7a7927c204bc95c2dfc4b9add0d493b22b22_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/klusterlet-addon-controller-rhel9@sha256:0a0bcadd7afc5273a4b8b08e41b69ce7ded300f180590d968214f4e553c6a3bf_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/console-rhel9@sha256:d312a7f9268ce8324dffe85efea54ceae252ab32464c80fb4320d15ed68914bb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/prometheus-rhel9@sha256:a6135fc0a00eb236cd8846fbc0747c95ead65577e417efcc76d87644440387e9_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:f9d19c046170f09dd61ad4c7b89f05bc6ddacd33474ec4941bf78943e22e719e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:6ef541b2db6a1e52ae77265775aaf42e19339f6dd0b06c741f686e185a3677ae_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:b868f808273ba046007a7c59f3736d087f5155ddb93d3a097d89d14db6d05459_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9@sha256:a0a8bb530b304ea8f832ee11c667668030b75a248211fd3a0e592174d4036e79_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:b32e29bee4238be225be3bec1249a0a45d37e6cbab7d120fdcb1deb6af1217a8_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-observability-rhel9-operator@sha256:efce4e9144d3354cf69332d723fc10bab931107c0d81f6b5274ed64f46fa4b86_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/mtv-integrations-rhel9@sha256:765056d0b7d0ff5049f88eec346e5077cfc8f2f7f3a281721e59b95fba5215e7_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:e5df835c3fa5a992a9f435b71c1ef6f33a0a66a2f86595d0bec6567ce2f49d0b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/metrics-collector-rhel9@sha256:d91a9bf029e8ea5da9b59ae17aa4b9470ef5207ea0dd7aa65a7cad084470d7cb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:30ed120a57847faad92481d07846d8dafc58a6a2aafbf61e8dbe5f6a8e5d5cfb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9@sha256:8d385688827ae4eacd72dd2ab7c5bb284ec3d6f63bd20e73721ef8472ecb1405_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
…and 164 more
Timeline
- Sep 15, 2026 CVE Published
- Sep 23, 2026 CVE Updated
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:67541 advisory
- https://access.redhat.com/security/cve/CVE-2025-53547 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-48586 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-66780 advisory
- https://access.redhat.com/security/cve/CVE-2026-71556 advisory
- https://access.redhat.com/security/cve/CVE-2026-89060 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67541.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2378905 issue
- https://www.cve.org/CVERecord?id=CVE-2025-53547 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-53547 advisory
- https://github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571 advisory
- https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484830 issue
…and 51 more