StackRadar

CVE-2024-26147

High

Advisory

Published 21 Feb 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.009
59th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
130
of 17,781 indexed, latest versions
Container images
127
deployed by those charts
Fix available
1 of 2
affected packages

Helm's Missing YAML Content Leads To Panic

Carried by container images the latest versions of 130 of 17,781 indexed charts deploy, on 127 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+55 more3.14.2127
helmdeb3.18.1-1no fix listed1
OSV records
GHSA-r53h-jv2g-vpx6UBUNTU-CVE-2024-26147
Also known as
BIT-helm-2024-26147, GO-2024-2575

Charts affected

130 by stars
ChartLatestAffected imagesRadar Score
vcluster-pro-eksloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-eks loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2

Open the chart page →

5,936
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.102 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
helm.sh/helm/v3@v3.10.3
3.14.2
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2

Open the chart page →

5,768
vcluster-pro-k8sloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2

Open the chart page →

8,202
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
helm.sh/helm/v3@v3.13.0
3.14.2

Open the chart page →

9,774
cert-manager-setupmesosphere-stable0.2.101 of 5See more

cert-manager-setup mesosphere-stable 0.2.10

1 of the 5 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
helm.sh/helm/v3@v3.10.3
3.14.2

Open the chart page →

7,179
istio-operatormetakube1.12.01 of 1See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
istio/operator:1.12.06cfce8a071b9
helm.sh/helm/v3@v3.7.1
3.14.2

Open the chart page →

8,902
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835
3.14.2

Open the chart page →

3,843
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
helm.sh/helm/v3@v0.0.0-20250616185904-6838ebcf265a
3.14.2

Open the chart page →

17,070
multicluster-meshocm-helm-chartsVerified publisher0.0.21 of 1See more

multicluster-mesh ocm-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
helm.sh/helm/v3@v3.8.0
3.14.2

Open the chart page →

2,124
fsmopenshift0.1.8-ubi.61 of 6See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
helm.sh/helm/v3@v3.7.1
3.14.2

Open the chart page →

16,556
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.14.2

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
helm.sh/helm/v3@v0.0.0-20240221201614-c309b6f0ff63
3.14.2

Open the chart page →

4,127
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.15.29242b4df9e65
helm.sh/helm/v3@v3.9.4
3.14.2

Open the chart page →

26,840
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
helm.sh/helm/v3@v0.0.0-20240612132704-1a500d562541
3.14.2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.2

Open the chart page →

25,934
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
helm.sh/helm/v3@v3.0.2
3.14.2

Open the chart page →

11,151
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.2

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.2

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac
3.14.2

Open the chart page →

3,270
quarksquarks7.0.1+0.g5396b111 of 5See more

quarks quarks 7.0.1+0.g5396b11

1 of the 5 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
helm.sh/helm/v3@v3.3.0
3.14.2

Open the chart page →

18,197
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
helm.sh/helm/v3@v3.3.4
3.14.2

Open the chart page →

29,227
backup-maker-controllerriotkit-org0.1.21 of 1See more

backup-maker-controller riotkit-org 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
helm.sh/helm/v3@v3.10.3
3.14.2

Open the chart page →

1,575
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.14.2

Open the chart page →

4,038
gitlab-operatorrock8sVerified publisher0.7.01 of 2See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
helm.sh/helm/v3@v3.7.0
3.14.2

Open the chart page →

5,422
mailserverrock8sVerified publisher0.1.21 of 1See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.14.2

Open the chart page →

1,946
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
helm.sh/helm/v3@v3.12.3
3.14.2
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.2

Open the chart page →

68,240
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.14.2

Open the chart page →

32,902
harborsoftonic1.13.03 of 8See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
helm.sh/helm/v3@v3.11.3
3.14.2
goharbor/harbor-jobservice:v2.9.039435daedd0c
helm.sh/helm/v3@v3.11.3
3.14.2
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
helm.sh/helm/v3@v3.12.1
3.14.2

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
helm.sh/helm/v3@v3.12.1
3.14.2

Open the chart page →

2,505
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
helm.sh/helm/v3@v3.11.0
3.14.2

Open the chart page →

6,232
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2024-26147.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2

Open the chart page →

13,677

Container images carrying it

127 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
istio/pilot:1.16.0ac0284d75ec9
helm.sh/helm/v3@v3.10.0
3.14.2
1
istio/pilot:1.17.1ce9d87606701
helm.sh/helm/v3@v3.11.0
3.14.2
1
istio/pilot:1.15.2db08d6963975
helm.sh/helm/v3@v3.9.4
3.14.2
1
keptnsandbox/job-executor-service:0.1.36e6d323dd7ae
helm.sh/helm/v3@v3.6.0
3.14.2
1
kubebb/core:v0.1.62b9e7f451d6b
helm.sh/helm/v3@v3.9.4
3.14.2
1
kubebb/core:lateste366c34a9b8d
helm.sh/helm/v3@v3.9.4
3.14.2
1
kubebb/mesh-operator:v5.7.0163ebbfc7a82
helm.sh/helm/v3@v3.10.3
3.14.2
1
kubeoperator/webkubectl:v2.4.0be8f0d624640
helm.sh/helm/v3@v3.2.0
3.14.2
1
kubesphere/ks-extensions-museum:latest29681958f220
helm.sh/helm/v3@v3.12.3
3.14.2
1
kubesphere/kubectl:v1.27.1649b445b1b732
helm.sh/helm/v3@v3.11.1
3.14.2
1
layer5/meshery-app-mesh:stable-latest77d59943b3d6
helm.sh/helm/v3@v3.9.4
3.14.2
1
layer5/meshery-consul:stable-latest25a4cc38abcd
helm.sh/helm/v3@v3.13.1
3.14.2
1
layer5/meshery-istio:stable-latestfde47c141ec6
helm.sh/helm/v3@v3.14.1
3.14.2
1
layer5/meshery-kuma:stable-latest9d25f029a8a2
helm.sh/helm/v3@v3.11.1
3.14.2
1
layer5/meshery-linkerd:stable-latestb99c73bac1f5
helm.sh/helm/v3@v3.14.1
3.14.2
1
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
helm.sh/helm/v3@v3.11.1
3.14.2
1
layer5/meshery-nsm:stable-latestebd6a8faf21f
helm.sh/helm/v3@v3.3.1
3.14.2
1
layer5/meshery-osm:stable-latestec898e5786c6
helm.sh/helm/v3@v3.11.1
3.14.2
1
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
helm.sh/helm/v3@v3.11.1
3.14.2
1
mavrick1/kubestellar-b:latest45ca0429a1d4
helm.sh/helm/v3@v0.0.0-20230501180843-c9f554d75773
3.14.2
1
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835
3.14.2
1
phntom/chartmuseum:v0.16.053883b65d9b7
helm.sh/helm/v3@v3.12.1
3.14.2
1
phntom/chartmuseum:v0.15.29242b4df9e65
helm.sh/helm/v3@v3.9.4
3.14.2
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
helm.sh/helm/v3@v3.0.2
3.14.2
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.2
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
helm.sh/helm/v3@v0.0.0-20240710191640-3bb50bbbdd9c
3.14.2
1
sstarcher/helm-exporter:0.5.011769d01ba35
helm.sh/helm/v3@v3.0.2
3.14.2
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
helm.sh/helm/v3@v0.0.0-20240814142712-fa9efb07d9d8
3.14.2
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
helm.sh/helm/v3@v3.12.1
3.14.2
1
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.2
1
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
helm.sh/helm/v3@v3.12.0
3.14.2
1
ghcr.io/caninehq/canine:latesta058034ca006
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.14.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
helm.sh/helm/v3@v3.9.4
3.14.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
helm.sh/helm/v3@v3.13.3
3.14.2
1
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
helm.sh/helm/v3@v3.3.0
3.14.2
1
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
helm.sh/helm/v3@v0.0.0-20251111020852-4f953c223ba2
3.14.2
1
ghcr.io/helm/chartmuseum:v0.16.071d1f1c0179e
helm.sh/helm/v3@v3.12.0
3.14.2
1
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
helm.sh/helm/v3@v3.9.0
3.14.2
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.2
1
ghcr.io/keel-hq/keel:0.22.3315e188a07c2
helm.sh/helm/v3@v3.13.1
3.14.2
1
ghcr.io/kluster-manager/cluster-proxy:latest27a5c64b7ea8
helm.sh/helm/v3@v3.11.1
3.14.2
1
ghcr.io/kluster-manager/managed-serviceaccount:latest365183f83ac9
helm.sh/helm/v3@v3.11.1
3.14.2
1
ghcr.io/kluster-manager/multicluster-controlplane:latest6de40f528be9
helm.sh/helm/v3@v3.14.1
3.14.2
1
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
helm.sh/helm/v3@v0.0.0-20221214143859-835b7334cfe2
3.14.2
1
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
helm.sh/helm/v3@v0.0.0-20241216182912-7877b45b63f9
3.14.2
1
ghcr.io/loft-sh/agent:3.2.45c109914ff73
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.14.2
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
helm.sh/helm/v3@v0.0.0-20240205060548-90a52fb06c21
3.14.2
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.14.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.