StackRadar

CVE-2026-35206

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
201
of 17,787 indexed, latest versions
Container images
210
deployed by those charts
Fix available
2 of 2
affected packages

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Carried by container images the latest versions of 201 of 17,787 indexed charts deploy, on 210 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+80 more3.20.2208
helm.sh/helm/v4golangv4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.34.1.45
OSV records
GHSA-hr2v-4r36-88hr
Also known as
BIT-helm-2026-35206, GO-2026-5435

Charts affected

201 by stars
ChartLatestAffected imagesRadar Score
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.20.2

Open the chart page →

13,197

Container images carrying it

210 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
beopenit/door-helm:v3.0.1b4d9f9bee224
helm.sh/helm/v3@v3.11.3
3.20.2
1
bsgrigorov/helm-operator:latest45ab095f09c8
helm.sh/helm/v3@v3.4.1
3.20.2
1
datawire/ambassador-operator:v1.3.0f95ae710d75c
helm.sh/helm/v3@v3.0.3
3.20.2
1
devopstales/trivy-operator:2.575136aa7a26e
helm.sh/helm/v3@v3.10.3
3.20.2
1
devspacecloud/manager:0.3.349c397413f7b
helm.sh/helm/v3@v3.1.0
3.20.2
1
djjudas21/nova-exporter:0.0.10e9094580885c
helm.sh/helm/v3@v3.18.4
3.20.2
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
helm.sh/helm/v3@v0.0.0-20230308205603-912ebc1cd10d
3.20.2
1
epamedp/edp-headlamp:0.25.093417e18bb1a
helm.sh/helm/v3@v3.14.2
3.20.2
1
flanksource/batch-runner:v1.0.44689687a7cf95
helm.sh/helm/v3@v3.17.3
3.20.2
1
flomesh/fsm-manager:0.2.1122f849c70b25
helm.sh/helm/v3@v3.11.1
3.20.2
1
fluxcd/helm-controller:v0.9.092b891e495d8
helm.sh/helm/v3@v3.5.3
3.20.2
1
fluxcd/source-controller:v0.10.031a8c79a6803
helm.sh/helm/v3@v3.5.3
3.20.2
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
helm.sh/helm/v3@v3.8.0
3.20.2
1
goharbor/harbor-core:v2.9.06412d679fdc3
helm.sh/helm/v3@v3.11.3
3.20.2
1
goharbor/harbor-core:v2.5.386bf3031f4a7
helm.sh/helm/v3@v3.7.1
3.20.2
1
goharbor/harbor-core:v2.14.3a30e5a8be3d9
helm.sh/helm/v3@v3.18.5
3.20.2
1
goharbor/harbor-core:v2.11.1c017dd84ee96
helm.sh/helm/v3@v3.14.4
3.20.2
1
goharbor/harbor-jobservice:v2.9.039435daedd0c
helm.sh/helm/v3@v3.11.3
3.20.2
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
helm.sh/helm/v3@v3.7.1
3.20.2
1
goharbor/harbor-jobservice:v2.14.3e2b0298e894d
helm.sh/helm/v3@v3.18.5
3.20.2
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
helm.sh/helm/v3@v3.19.2
3.20.2
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
helm.sh/helm/v3@v3.9.0
3.20.2
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
helm.sh/helm/v3@v3.12.1
3.20.2
1
grpl/grapple-cli:0.2.127c00aafee6629
helm.sh/helm/v3@v0.0.0-20241009191611-13654a52f7c7
3.20.2
1
hashicorp/waypoint:0.11.397d521a27498
helm.sh/helm/v3@v3.9.4
3.20.2
1
inseefrlab/shelly:cloudshell31f04ca7436b
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.20.2
1
istio/operator:1.10.3655eefa11c84
helm.sh/helm/v3@v3.5.3
3.20.2
1
istio/operator:1.12.06cfce8a071b9
helm.sh/helm/v3@v3.7.1
3.20.2
1
istio/operator:1.18.270f9d1fe5fff
helm.sh/helm/v3@v3.11.2
3.20.2
1
istio/pilot:1.16.0ac0284d75ec9
helm.sh/helm/v3@v3.10.0
3.20.2
1
istio/pilot:1.17.1ce9d87606701
helm.sh/helm/v3@v3.11.0
3.20.2
1
istio/pilot:1.15.2db08d6963975
helm.sh/helm/v3@v3.9.4
3.20.2
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
helm.sh/helm/v3@v3.19.0
3.20.2
1
keptnsandbox/job-executor-service:0.1.36e6d323dd7ae
helm.sh/helm/v3@v3.6.0
3.20.2
1
kubebb/core:v0.1.62b9e7f451d6b
helm.sh/helm/v3@v3.9.4
3.20.2
1
kubebb/core:lateste366c34a9b8d
helm.sh/helm/v3@v3.9.4
3.20.2
1
kubebb/mesh-operator:v5.7.0163ebbfc7a82
helm.sh/helm/v3@v3.10.3
3.20.2
1
kubeoperator/webkubectl:v2.4.0be8f0d624640
helm.sh/helm/v3@v3.2.0
3.20.2
1
kubesphere/ks-extensions-museum:latest29681958f220
helm.sh/helm/v3@v3.12.3
3.20.2
1
kubesphere/kubectl:v1.27.1649b445b1b732
helm.sh/helm/v3@v3.11.1
3.20.2
1
layer5/meshery:stable-latest78a8be21bef3
helm.sh/helm/v3@v3.17.3
3.20.2
1
layer5/meshery-app-mesh:stable-latest77d59943b3d6
helm.sh/helm/v3@v3.9.4
3.20.2
1
layer5/meshery-consul:stable-latest25a4cc38abcd
helm.sh/helm/v3@v3.13.1
3.20.2
1
layer5/meshery-istio:stable-latestfde47c141ec6
helm.sh/helm/v3@v3.14.1
3.20.2
1
layer5/meshery-kuma:stable-latest9d25f029a8a2
helm.sh/helm/v3@v3.11.1
3.20.2
1
layer5/meshery-linkerd:stable-latestb99c73bac1f5
helm.sh/helm/v3@v3.14.1
3.20.2
1
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
helm.sh/helm/v3@v3.11.1
3.20.2
1
layer5/meshery-nsm:stable-latestebd6a8faf21f
helm.sh/helm/v3@v3.3.1
3.20.2
1
layer5/meshery-osm:stable-latestec898e5786c6
helm.sh/helm/v3@v3.11.1
3.20.2
1
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
helm.sh/helm/v3@v3.11.1
3.20.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.