CVE-2019-25210
mediumpriority · track · 26EPSS 0.007 · 52 %ileDEEURUUSEPSS · scored 2026-10-27
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (66)
Products and version ranges known to be affected.
- Red Hat Ansible Automation Platformall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:-
- Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
- Red Hat OpenShift API for Data Protection 1all versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection_1
- Red Hat OpenShift Kube Descheduler Operator 5all versionscert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
- Red Hat OpenShift Run Once Duration Override Operator 1all versionscert_bundDEcpe:/a:redhat:openshift:run_once_duration_override_operator_1
- Red Hat OpenShift Secondary Scheduler Operatorall versionscert_bundDEcpe:/a:redhat:openshift:::secondary_scheduler_operator
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
- GHSA-jw44-4f3j-q396Withdrawn Advisory: Helm shows secrets in clear text2024-03-03ghsa · osvUS
### Withdrawn Advisory This advisory has been withdrawn because the issue describes intended behavior and the output is not exposed to unauthorized users. This link has been maintained to preserve external references. ### Original Description An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2019-25210/cnnvd
- https://github.com/helm/helm/issues/7275cnnvd
- https://helm.sh/blog/response-cve-2019-25210/cnnvd
- https://www.cncf.io/projects/helm/cnnvd
- https://github.com/helm/helm/issues/7275enisa_euvd
- https://helm.sh/blog/response-cve-2019-25210/enisa_euvd
- https://www.cncf.io/projects/helm/enisa_euvd
- https://github.com/helm/helm/issues/7275Issue Trackingnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan