Skip to content
Fencer Vulns
medium 6.8

CVE-2021-32690 json

Repository credentials passed to alternate domain

published 2021-06-16 5 y ago modified 2026-09-10 1 mo ago also BIT-helm-2021-32690 , EUVD-2021-1265 , GHSA-56hp-xqp3-w2jf , GHSA-7jr6-prv4-5wf5 , GO-2022-0384

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.

Patch / fix

  • go helm.sh/helm/v3 3.6.1
  • bitnami helm 3.6.1
  • helm helm 3.6.1
  • helm Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.6.1-r0

alpine advisories ALPINE-CVE-2021-32690

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • helm CBL-Mariner 2.0 3.4.1-4

azure linux advisories AZL-6471

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • helm Arch Linux 3.6.1-1

arch linux advisories AVG-2078

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32690 updated cvss 6.8

helm: information disclosure vulnerability

  • Red Hat OpenShift Developer Tools and Services helm
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 1 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-galley, servicemesh-citadel, servicemesh-istioctl, +4 more
    affected: no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Management for Kubernetes 2 multicloud-operators-channel, multicloud-operators-foundation, multicloud-operators-application, multicloud-operators-subscription, multicloud-operators-subscription-release Red Hat Ansible Automation Platform 1.2 helm Red Hat Ansible Automation Platform 2 helm
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-helm-operator, openshift4/ose-ansible-operator, openshift4/ose-operator-sdk-rhel8, openshift4/ose-metering-helm-container-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift web-terminal-tech-preview/web-terminal-exec-rhel8 1.3-9, web-terminal-tech-preview/web-terminal-tooling-rhel8 1.3-6, web-terminal-tech-preview/web-terminal-rhel8-operator 1.3-20, web-terminal-tech-preview/web-terminal-rhel8-operator-metadata 1.3-19
    fixed: vendor fix RHEA-2021:3139
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-console v4.9.0-202110130449.p0.git.8c077e4.assembly.rc.8
    fixed: vendor fix RHSA-2021:3759
  • Red Hat RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator 3.67.0-3
    fixed: vendor fix RHSA-2021:4902
  • Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-operator, servicemesh-pilot-agent, +1 more Red Hat Advanced Cluster Management for Kubernetes 2 rcm-controller, search-operator, search-collector, endpoint-operator, rhacm2/work-rhel8, search-aggregator, +50 more Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202109302317.p0.git.96e95ce.assembly.stream, openshift4/ose-pod v4.9.0-202110080828.p0.git.894a78b.assembly.stream, openshift4/ose-etcd v4.9.0-202109302317.p0.git.5c1feaf.assembly.stream, openshift4/ose-tests v4.9.0-202110011028.p0.git.6105395.assembly.stream, openshift4/ose-coredns v4.9.0-202109302317.p0.git.3cb11c0.assembly.stream, openshift4/ose-grafana v4.9.0-202109302317.p0.git.6130ba8.assembly.stream, +141 more Red Hat OpenStack Platform 16.2 osp-director-provisioner-container, rhosp-rhel8-tech-preview/osp-director-operator, rhosp-rhel8-tech-preview/osp-director-downloader Red Hat RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-operator-bundle 3.67.0-2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
OSV 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go helm.sh/helm/v3
<3.6.1
3.6.1
bitnami helm
<3.6.1
3.6.1

Affected products

  • helm helm

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.