CVE-2020-11013

What it is

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure.

Exploit odds

1.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2020-04-24 20:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 02:48 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 1.4% in the next 30 days (EPSS).
• Severity: 8.5 HIGH (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2020-04-24 20:15 UTC

Last modified

2026-06-17 02:48 UTC

Exploit probability

1.4% · EPSS, next 30 days

Weakness

CWE-200 · Information exposure

Record status

Modified

Affected

• Helm < 3.2.0

Attack profile CVSS 3.1 · 8.5

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2020-11013.md and follow it. Check whether this project is affected by CVE-2020-11013. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge