{"cve":"CVE-2021-32690","nvd":{"published":"2021-06-16T22:15:07.737","modified":"2026-06-17T03:53:25.950","status":"Modified","description":"Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6},"cwes":["CWE-200"],"references":["https://github.com/helm/helm/releases/tag/v3.6.1","https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf","https://github.com/helm/helm/releases/tag/v3.6.1","https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf"],"products":["helm:helm"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-32690","score":0.01434,"percentile":0.7309,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-56hp-xqp3-w2jf","url":"https://osv.dev/vulnerability/GHSA-56hp-xqp3-w2jf","summary":"Helm passes repository credentials to alternate domain","modified":"2026-09-10T03:49:15.199568593Z","packages":[{"ecosystem":"Go","name":"helm.sh/helm/v3","purl":"pkg:golang/helm.sh/helm/v3","ranges":["<3.6.1"],"fixed":["3.6.1"]}]},{"id":"GO-2022-0384","url":"https://osv.dev/vulnerability/GO-2022-0384","summary":"Repository credentials passed to alternate domain in helm.sh/helm/v3","modified":"2026-02-04T04:12:59.421557Z","packages":[{"ecosystem":"Go","name":"helm.sh/helm/v3","purl":"pkg:golang/helm.sh/helm/v3","ranges":["<3.6.1"],"fixed":["3.6.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}