CVE-2024-26147

High

Advisory

Published 21 Feb 2024In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.009; 59th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 130; of 17,781 indexed, latest versions
Container images: 127; deployed by those charts
Fix available: 1 of 2; affected packages

Helm's Missing YAML Content Leads To Panic

Carried by container images the latest versions of 130 of 17,781 indexed charts deploy, on 127 images.

Affected package	Affected versions	Fixed in	Images
helm.sh/helm/v3golang	v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+55 more	3.14.2	127
helmdeb	3.18.1-1	no fix listed	1

OSV records: GHSA-r53h-jv2g-vpx6 UBUNTU-CVE-2024-26147
Also known as: BIT-helm-2024-26147, GO-2024-2575

Charts affected

130 by stars

Chart

Latest

Affected images

Radar Score

vcluster-pro-eksloft

0.0.0-ci-run.10

1 of 4 See more

vcluster-pro-eks loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.14.2

Open the chart page →

5,936

vcluster-pro-k0sloft

0.0.0-ci-run.10

2 of 2 See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	helm.sh/helm/v3@v3.10.3	3.14.2
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.14.2

Open the chart page →

5,768

vcluster-pro-k8sloft

0.0.0-ci-run.10

1 of 4 See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.14.2

Open the chart page →

8,202

m9sweeperm9sweeper

1.6.0

1 of 6 See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
ghcr.io/m9sweeper/trawler :1.6.0	df917c5a7e54	helm.sh/helm/v3@v3.13.0	3.14.2

Open the chart page →

9,774

cert-manager-setupmesosphere-stable

0.2.10

1 of 5 See more

cert-manager-setup mesosphere-stable 0.2.10

1 of the 5 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-ctl :v1.11.0	74611761f052	helm.sh/helm/v3@v3.10.3	3.14.2

Open the chart page →

7,179

istio-operatormetakube

1.12.0

1 of 1 See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
istio/operator :1.12.0	6cfce8a071b9	helm.sh/helm/v3@v3.7.1	3.14.2

Open the chart page →

8,902

agent-controlnewrelic

0.0.92

1 of 1 See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
newrelic/newrelic-agent-control-cli :0.48.0	1a448492b55a	helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835	3.14.2

Open the chart page →

3,843

lensoci-ai-incubations

0.1.14

1 of 16 See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
alpine/k8s :1.31.10	6dbe6f391eda	helm.sh/helm/v3@v0.0.0-20250616185904-6838ebcf265a	3.14.2

Open the chart page →

17,070

multicluster-meshocm-helm-charts

0.0.2

1 of 1 See more

multicluster-mesh ocm-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/open-cluster-management/multicluster-mesh-addon :latest	3e010e1188f1	helm.sh/helm/v3@v3.8.0	3.14.2

Open the chart page →

2,124

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/flomesh/fsm-manager-ubi8 :0.1.8-ubi.6	3590af73f65a	helm.sh/helm/v3@v3.7.1	3.14.2

Open the chart page →

16,556

harikubeopenshift

0.16.3

1 of 3 See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/harikube/vcluster-pro :0.32.1	b741efae8d31	helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6	3.14.2

Open the chart page →

2,525

kb-cloud-installeropenshift

2.1.35

1 of 1 See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
apecloud/kb-cloud-installer :v2.1.42-certified	98abc64aa985	helm.sh/helm/v3@v0.0.0-20240221201614-c309b6f0ff63	3.14.2

Open the chart page →

4,127

npre-essentialsphntom

0.1.60

1 of 22 See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
phntom/chartmuseum :v0.15.2	9242b4df9e65	helm.sh/helm/v3@v3.9.4	3.14.2

Open the chart page →

26,840

planectlplanectl

0.7.0

2 of 10 See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
alpine/k8s :1.30.2	cd560fce90f7	helm.sh/helm/v3@v0.0.0-20240612132704-1a500d562541	3.14.2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e	3.14.2

Open the chart page →

25,934

gitlab-runner-operatorpnnl-miscscripts

0.1.6

1 of 1 See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	helm.sh/helm/v3@v3.0.2	3.14.2

Open the chart page →

11,151

tenant-namespace-operatorpnnl-miscscripts

0.1.28

1 of 1 See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
pnnlmiscscripts/tenant-namespace-operator :0.1.24-1	8af4b7551d40	helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366	3.14.2

Open the chart page →

12,754

prismeai-appsprismeai

0.7.1

1 of 4 See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac	3.14.2

Open the chart page →

2,751

prismeai-coreprismeai

1.12.1

1 of 7 See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac	3.14.2

Open the chart page →

3,270

quarksquarks

7.0.1+0.g5396b11

1 of 5 See more

quarks quarks 7.0.1+0.g5396b11

1 of the 5 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
ghcr.io/cloudfoundry-incubator/quarks-secret :v1.0.754	f059af4de8ed	helm.sh/helm/v3@v3.3.0	3.14.2

Open the chart page →

18,197

stackrox-chartredhat-cop

0.0.10

1 of 1 See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	helm.sh/helm/v3@v3.3.4	3.14.2

Open the chart page →

29,227

backup-maker-controllerriotkit-org

0.1.2

1 of 1 See more

backup-maker-controller riotkit-org 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
ghcr.io/riotkit-org/backup-maker-controller :v0.1.2	62370545ba3d	helm.sh/helm/v3@v3.10.3	3.14.2

Open the chart page →

1,575

krr-enforcerrobusta

0.3.5

1 of 2 See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
alpine/k8s :1.30.0	bd01dae02676	helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346	3.14.2

Open the chart page →

4,038

gitlab-operatorrock8s

0.7.0

1 of 2 See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	helm.sh/helm/v3@v3.7.0	3.14.2

Open the chart page →

5,422

mailserverrock8s

0.1.2

1 of 1 See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e	3.14.2

Open the chart page →

1,946

devtron-enterpriseromholdings

48.0.0

2 of 28 See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	helm.sh/helm/v3@v3.12.3	3.14.2
quay.io/devtron/kubectl :latest	2ad610626658	helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4	3.14.2

Open the chart page →

68,240

devtron-operatorromholdings

0.23.3

1 of 11 See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
quay.io/devtron/kubectl :latest	2ad610626658	helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4	3.14.2

Open the chart page →

32,902

harborsoftonic

1.13.0

3 of 8 See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.9.0	6412d679fdc3	helm.sh/helm/v3@v3.11.3	3.14.2
goharbor/harbor-jobservice :v2.9.0	39435daedd0c	helm.sh/helm/v3@v3.11.3	3.14.2
goharbor/trivy-adapter-photon :v2.9.0	dc5b882a7db4	helm.sh/helm/v3@v3.12.1	3.14.2

Open the chart page →

7,672

trivy-operatorsoftonic

0.18.0

1 of 1 See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
ghcr.io/aquasecurity/trivy-operator :0.16.0	a608b798fda5	helm.sh/helm/v3@v3.12.1	3.14.2

Open the chart page →

2,505

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	helm.sh/helm/v3@v3.11.0	3.14.2

Open the chart page →

6,232

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2024-26147.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.14.2

Open the chart page →

13,677

Container images carrying it

127 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/loft-sh/loft :0.0.0-ci.14	b69bcdaa8492	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.14.2	1
ghcr.io/loft-sh/vcluster :0.16.4	84f70425f4dd	helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e	3.14.2	1
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	helm.sh/helm/v3@v0.0.0-20240205060548-90a52fb06c21	3.14.2	1
ghcr.io/m9sweeper/trawler :1.6.0	df917c5a7e54	helm.sh/helm/v3@v3.13.0	3.14.2	1
ghcr.io/pipe-cd/pipecd :v0.39.0	0fae829caf29	helm.sh/helm/v3@v3.2.0	3.14.2	1
ghcr.io/riotkit-org/backup-maker-controller :v0.1.2	62370545ba3d	helm.sh/helm/v3@v3.10.3	3.14.2	1
public.ecr.aws/aktosecurity/keelhq-keel :akto_v1.0.0	1eb61443d68e	helm.sh/helm/v3@v3.13.1	3.14.2	1
quay.io/argoproj/argocd :v3.0.3	95b5cf7ba6fe	helm.sh/helm/v3@v0.0.0-20250212201646-980d8ac1939e	3.14.2	1
quay.io/argoproj/argocd :v3.1.1	a36ab0c0860c	helm.sh/helm/v3@v0.0.0-20250708195800-d80839cf37d8	3.14.2	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	helm.sh/helm/v3@v0.0.0-20230614175909-f32a527a0601	3.14.2	1
quay.io/bentoml/yatai :0.4.6	14b482c1f1b8	helm.sh/helm/v3@v3.8.2	3.14.2	1
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	helm.sh/helm/v3@v3.11.1	3.14.2	1
quay.io/flomesh/fsm-manager-ubi8 :0.1.8-ubi.6	3590af73f65a	helm.sh/helm/v3@v3.7.1	3.14.2	1
quay.io/harikube/vcluster-pro :0.32.1	b741efae8d31	helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6	3.14.2	1
quay.io/jetstack/cert-manager-ctl :v1.13.2	4d9fce2c050e	helm.sh/helm/v3@v3.12.3	3.14.2	1
quay.io/jetstack/cert-manager-ctl :v1.8.0	595c548dee6f	helm.sh/helm/v3@v3.8.1	3.14.2	1
quay.io/jetstack/cert-manager-ctl :v1.8.2	81b2d775edad	helm.sh/helm/v3@v3.8.1	3.14.2	1
quay.io/jetstack/cert-manager-ctl :v1.12.0	8d54fe9d0c0d	helm.sh/helm/v3@v3.12.0	3.14.2	1
quay.io/kubermatic/kubermatic :v2.24.5	ebba936046ab	helm.sh/helm/v3@v3.12.2	3.14.2	1
quay.io/mittwald/brudi-operator :v0.2.3	edb322094359	helm.sh/helm/v3@v3.11.3	3.14.2	1
quay.io/open-cluster-management/multicluster-mesh-addon :latest	3e010e1188f1	helm.sh/helm/v3@v3.8.0	3.14.2	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	helm.sh/helm/v3@v3.7.1	3.14.2	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	helm.sh/helm/v3@v3.3.4	3.14.2	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	helm.sh/helm/v3@v3.6.3	3.14.2	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	helm.sh/helm/v3@v3.6.3	3.14.2	1
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e	3.14.2	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	helm.sh/helm/v3@v3.7.0	3.14.2	1