StackRadar

CVE-2026-35206

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
201
of 17,787 indexed, latest versions
Container images
210
deployed by those charts
Fix available
2 of 2
affected packages

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Carried by container images the latest versions of 201 of 17,787 indexed charts deploy, on 210 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+80 more3.20.2208
helm.sh/helm/v4golangv4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.34.1.45
OSV records
GHSA-hr2v-4r36-88hr
Also known as
BIT-helm-2026-35206, GO-2026-5435

Charts affected

201 by stars
ChartLatestAffected imagesRadar Score
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.20.2

Open the chart page →

13,197

Container images carrying it

210 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
logiqai/flash:v3.10.265b996bc7bdc
helm.sh/helm/v3@v3.14.2
3.20.2
1
mavrick1/kubestellar-b:latest45ca0429a1d4
helm.sh/helm/v3@v0.0.0-20230501180843-c9f554d75773
3.20.2
1
milvusdb/milvus-operator:v1.3.95d63c8894f3a
helm.sh/helm/v3@v3.18.5
3.20.2
1
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.20.2
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
helm.sh/helm/v3@v0.0.0-20250819195950-b76a950f6835
3.20.2
1
phntom/chartmuseum:v0.16.053883b65d9b7
helm.sh/helm/v3@v3.12.1
3.20.2
1
phntom/chartmuseum:v0.15.29242b4df9e65
helm.sh/helm/v3@v3.9.4
3.20.2
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
helm.sh/helm/v3@v3.17.0
3.20.2
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
helm.sh/helm/v4@v4.1.0
3.20.2
4.1.4
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.20.2
1
replicated/replicated-sdk:1.0.0-beta.318751b4963250
helm.sh/helm/v3@v3.15.4
3.20.2
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
helm.sh/helm/v3@v0.0.0-20240710191640-3bb50bbbdd9c
3.20.2
1
sstarcher/helm-exporter:0.5.011769d01ba35
helm.sh/helm/v3@v3.0.2
3.20.2
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
helm.sh/helm/v3@v0.0.0-20240814142712-fa9efb07d9d8
3.20.2
1
gcr.io/istio-testing/operator:latest8d4576f7b98f
helm.sh/helm/v3@v3.15.1
3.20.2
1
ghcr.io/appscode/catalog-manager:v0.13.0fc336c5b9655
helm.sh/helm/v3@v3.19.5
3.20.2
1
ghcr.io/appscode/license-proxyserver:v0.0.8d6c2532ea386
helm.sh/helm/v3@v3.14.2
3.20.2
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
helm.sh/helm/v3@v3.12.1
3.20.2
1
ghcr.io/argonix-io/argonix-api:1.0.0cb5f24732197
helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e
3.20.2
1
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
helm.sh/helm/v3@v3.12.0
3.20.2
1
ghcr.io/buoyantio/metrics-api:preview-25.4.32cef2a3f97da
helm.sh/helm/v3@v3.17.2
3.20.2
1
ghcr.io/buoyantio/tap:preview-25.4.3e02a8bd9e2c3
helm.sh/helm/v3@v3.17.2
3.20.2
1
ghcr.io/buoyantio/web:preview-25.4.33ee1b62aa111
helm.sh/helm/v3@v3.17.2
3.20.2
1
ghcr.io/caninehq/canine:latesta058034ca006
helm.sh/helm/v3@v3.16.3
3.20.2
1
ghcr.io/cerbos/cerbos:0.51.08d35a64e4a99
helm.sh/helm/v3@v3.20.0
3.20.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.0091b906a0b13
helm.sh/helm/v3@v3.18.6
3.20.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
helm.sh/helm/v3@v3.9.4
3.20.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
helm.sh/helm/v3@v3.13.3
3.20.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.49e48285bb44c
helm.sh/helm/v3@v3.18.6
3.20.2
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.3bdb31f3121a2
helm.sh/helm/v3@v3.18.6
3.20.2
1
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
helm.sh/helm/v3@v3.3.0
3.20.2
1
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
helm.sh/helm/v3@v0.0.0-20251111020852-4f953c223ba2
3.20.2
1
ghcr.io/clusternet/clusternet-controller-manager:v1.0.02ce077d3d02d
helm.sh/helm/v3@v3.15.2
3.20.2
1
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
helm.sh/helm/v3@v3.15.2
3.20.2
1
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
helm.sh/helm/v3@v3.15.2
3.20.2
1
ghcr.io/fluxcd/flux-cli:v2.5.1274a179fd402
helm.sh/helm/v3@v3.17.0
3.20.2
1
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
helm.sh/helm/v3@v3.17.1
3.20.2
1
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
helm.sh/helm/v3@v3.17.0
3.20.2
1
ghcr.io/grafana/alloy-operator:1.3.02088dcb22aaa
helm.sh/helm/v3@v3.18.4
3.20.2
1
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
helm.sh/helm/v3@v3.18.6
3.20.2
1
ghcr.io/grafana/alloy-operator:1.12.14ee4b71cf16a
helm.sh/helm/v3@v3.18.6
3.20.2
1
ghcr.io/grafana/alloy-operator:1.8.1ae85d68749c7
helm.sh/helm/v3@v3.18.6
3.20.2
1
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
helm.sh/helm/v3@v3.19.4
3.20.2
1
ghcr.io/helm/chartmuseum:v0.16.071d1f1c0179e
helm.sh/helm/v3@v3.12.0
3.20.2
1
ghcr.io/helm/chartmuseum:v0.14.0878ef6a31fa0
helm.sh/helm/v3@v3.8.0
3.20.2
1
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
helm.sh/helm/v3@v3.9.0
3.20.2
1
ghcr.io/helm/chartmuseum:v0.16.3c81f105c3682
helm.sh/helm/v3@v3.17.3
3.20.2
1
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
helm.sh/helm/v3@v3.18.1
3.20.2
1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
helm.sh/helm/v3@v3.18.6
helm.sh/helm/v4@v4.1.3
3.20.2
4.1.4
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
helm.sh/helm/v3@v3.19.0
3.20.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.