StackRadar

CVE-2026-35206

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
196
of 17,781 indexed, latest versions
Container images
207
deployed by those charts
Fix available
2 of 2
affected packages

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Carried by container images the latest versions of 196 of 17,781 indexed charts deploy, on 207 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+79 more3.20.2205
helm.sh/helm/v4golangv4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.34.1.45
OSV records
GHSA-hr2v-4r36-88hr
Also known as
BIT-helm-2026-35206, GO-2026-5435

Charts affected

196 by stars
ChartLatestAffected imagesRadar Score
devtron-operatordevtron-labs0.23.34 of 11See more

devtron-operator devtron-labs 0.23.3

4 of the 11 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
helm.sh/helm/v3@v3.20.1
3.20.2
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
helm.sh/helm/v3@v3.18.6
3.20.2
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.20.2
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
helm.sh/helm/v3@v3.18.6
3.20.2

Open the chart page →

32,902
nova-exporterdjjudas21Verified publisher0.1.161 of 1See more

nova-exporter djjudas21 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
djjudas21/nova-exporter:0.0.10e9094580885c
helm.sh/helm/v3@v3.18.4
3.20.2

Open the chart page →

1,411
k8s-crondoubanVerified publisher0.2.01 of 1See more

k8s-cron douban 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
alpine/k8s:1.28.2fc059f056ad0
helm.sh/helm/v3@v0.0.0-20230918200057-825e86f6a7a3
3.20.2

Open the chart page →

3,659
edp-headlampepmdedpVerified publisher0.25.01 of 1See more

edp-headlamp epmdedp 0.25.0

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
epamedp/edp-headlamp:0.25.093417e18bb1a
helm.sh/helm/v3@v3.14.2
3.20.2

Open the chart page →

1,259
chaos-meshethereum-helm-chartsVerified publisher0.0.31 of 4See more

chaos-mesh ethereum-helm-charts 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.8.0091b906a0b13
helm.sh/helm/v3@v3.18.6
3.20.2

Open the chart page →

12,127
batchrunnerflanksourceVerified publisher1.0.441 of 1See more

batchrunner flanksource 1.0.44

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
flanksource/batch-runner:v1.0.44689687a7cf95
helm.sh/helm/v3@v3.17.3
3.20.2

Open the chart page →

5,292
mission-control-tenantflanksourceVerified publisher1.0.921 of 3See more

mission-control-tenant flanksource 1.0.92

1 of the 3 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster:0.16.484f70425f4dd
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.20.2

Open the chart page →

5,684
fluxcd-helm-upgraderfluxcd-helm-upgraderVerified publisher0.7.71 of 1See more

fluxcd-helm-upgrader fluxcd-helm-upgrader 0.7.7

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
helm.sh/helm/v3@v3.19.0
3.20.2

Open the chart page →

2,420
harborgpg-dev1.18.33 of 8See more

harbor gpg-dev 1.18.3

3 of the 8 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.14.3a30e5a8be3d9
helm.sh/helm/v3@v3.18.5
3.20.2
goharbor/harbor-jobservice:v2.14.3e2b0298e894d
helm.sh/helm/v3@v3.18.5
3.20.2
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
helm.sh/helm/v3@v3.19.2
3.20.2

Open the chart page →

3,376
grafana-cloud-onboardinggrafana0.4.71 of 5See more

grafana-cloud-onboarding grafana 0.4.7

1 of the 5 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.8.1ae85d68749c7
helm.sh/helm/v3@v3.18.6
3.20.2

Open the chart page →

4,637
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.3.02088dcb22aaa
helm.sh/helm/v3@v3.18.4
3.20.2

Open the chart page →

8,188
siembolgresearch0.1.61 of 4See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
alpine/k8s:1.18.16a41efe02a041
helm.sh/helm/v3@v3.5.1
3.20.2

Open the chart page →

14,312
helmfile-gitops-agenthelmfile-gitops-agentVerified publisher1.1.961 of 3See more

helmfile-gitops-agent helmfile-gitops-agent 1.1.96

1 of the 3 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
helm.sh/helm/v3@v3.18.1
3.20.2

Open the chart page →

2,594
harborhelm-harborVerified publisher2.3.52 of 8See more

harbor helm-harbor 2.3.5

2 of the 8 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.15.2d7b780d23721
helm.sh/helm/v3@v3.18.5
3.20.2
goharbor/harbor-jobservice:v2.15.2f71a4452a095
helm.sh/helm/v3@v3.18.5
3.20.2

Open the chart page →

1,650
release-cleanerhelm-release-cleanerVerified publisher1.0.01 of 1See more

release-cleaner helm-release-cleaner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
alpine/helm:4.1.0905a068da431
helm.sh/helm/v4@v4.1.0
4.1.4

Open the chart page →

2,000
cac-systemhuangchengwu-helm-chart0.1.01 of 9See more

cac-system huangchengwu-helm-chart 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.12.08d54fe9d0c0d
helm.sh/helm/v3@v3.12.0
3.20.2

Open the chart page →

11,186
monitoring-stackict-platformVerified publisher0.4.01 of 13See more

monitoring-stack ict-platform 0.4.0

1 of the 13 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
helm.sh/helm/v3@v3.18.6
3.20.2

Open the chart page →

9,573
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.20.2

Open the chart page →

2,165
kore-boardimprowisedVerified publisher0.5.81 of 4See more

kore-board improwised 0.5.8

1 of the 4 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
helm.sh/helm/v3@v0.0.0-20221214143859-835b7334cfe2
3.20.2

Open the chart page →

16,212
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.20.2

Open the chart page →

10,494
koptimizejaconiVerified publisher0.5.41 of 2See more

koptimize jaconi 0.5.4

1 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
alpine/k8s:1.27.321b24e6bf801
helm.sh/helm/v3@v3.11.3
3.20.2

Open the chart page →

5,713
deploydefenderk8s-custom-controllerVerified publisher0.1.31 of 1See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
helm.sh/helm/v3@v3.15.3
3.20.2

Open the chart page →

1,893
k8s-dev-podk8s-dev-pod0.3.11 of 1See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
helm.sh/helm/v3@v0.0.0-20250527180604-f6f8700a539c
3.20.2

Open the chart page →

8,811
librephotosk8sonlabVerified publisher1.1.61 of 7See more

librephotos k8sonlab 1.1.6

1 of the 7 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
alpine/k8s:1.22.600ac10bcb759
helm.sh/helm/v3@v3.7.1
3.20.2

Open the chart page →

14,801
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
helm.sh/helm/v3@v3.18.6
helm.sh/helm/v4@v4.1.3
3.20.2
4.1.4

Open the chart page →

2,900
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
istio/pilot:1.15.2db08d6963975
helm.sh/helm/v3@v3.9.4
3.20.2

Open the chart page →

19,168
installerkrateo2.7.12 of 2See more

installer krateo 2.7.1

2 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
dtzar/helm-kubectl:3.14.455429449408e
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.20.2
ghcr.io/krateoplatformops/installer/installer:0.6.3a7e922ddac55
helm.sh/helm/v3@v3.19.3
3.20.2

Open the chart page →

3,236
installer-pre-upgradekrateo2.7.11 of 1See more

installer-pre-upgrade krateo 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
dtzar/helm-kubectl:3.14.455429449408e
helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346
3.20.2

Open the chart page →

2,534
pipecdkrzwiatrzyk0.39.01 of 3See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
helm.sh/helm/v3@v3.2.0
3.20.2

Open the chart page →

3,812
chartmuseumkubebb3.10.21 of 1See more

chartmuseum kubebb 3.10.2

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.16.071d1f1c0179e
helm.sh/helm/v3@v3.12.0
3.20.2

Open the chart page →

2,267
kubebbkubebb0.0.11 of 1See more

kubebb kubebb 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
kubebb/core:lateste366c34a9b8d
helm.sh/helm/v3@v3.9.4
3.20.2

Open the chart page →

1,749
kubebb-corekubebb0.1.271 of 1See more

kubebb-core kubebb 0.1.27

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
kubebb/core:v0.1.62b9e7f451d6b
helm.sh/helm/v3@v3.9.4
3.20.2

Open the chart page →

1,938
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
kubebb/mesh-operator:v5.7.0163ebbfc7a82
helm.sh/helm/v3@v3.10.3
3.20.2

Open the chart page →

6,490
chaos-meshkubeblocksVerified publisher2.7.21 of 4See more

chaos-mesh kubeblocks 2.7.2

1 of the 4 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
helm.sh/helm/v3@v3.13.3
3.20.2

Open the chart page →

13,497
brudi-operatorkubernetes-replicator0.2.31 of 1See more

brudi-operator kubernetes-replicator 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
quay.io/mittwald/brudi-operator:v0.2.3edb322094359
helm.sh/helm/v3@v3.11.3
3.20.2

Open the chart page →

3,622
harbor-operatorkubernetes-replicator1.6.31 of 1See more

harbor-operator kubernetes-replicator 1.6.3

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
quay.io/mittwald/harbor-operator:v1.6.365a38180e27a
helm.sh/helm/v3@v3.14.4
3.20.2

Open the chart page →

1,196
harborkubesphereVerified publisher1.9.34 of 11See more

harbor kubesphere 1.9.3

4 of the 11 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
helm.sh/helm/v3@v3.8.0
3.20.2
goharbor/harbor-core:v2.5.386bf3031f4a7
helm.sh/helm/v3@v3.7.1
3.20.2
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
helm.sh/helm/v3@v3.7.1
3.20.2
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
helm.sh/helm/v3@v3.9.0
3.20.2

Open the chart page →

17,798
chaos-meshkubesphere-stable2.5.11 of 3See more

chaos-mesh kubesphere-stable 2.5.1

1 of the 3 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
helm.sh/helm/v3@v3.9.4
3.20.2

Open the chart page →

8,555
kubestellar-consolekubestellar-consoleVerified publisher0.3.411 of 2See more

kubestellar-console kubestellar-console 0.3.41

1 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
alpine/k8s:1.32.47e1e7d5b7a96
helm.sh/helm/v3@v3.17.2
3.20.2

Open the chart page →

4,439
kubestellar-uikubestellaruiVerified publisher0.1.11 of 4See more

kubestellar-ui kubestellarui 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
mavrick1/kubestellar-b:latest45ca0429a1d4
helm.sh/helm/v3@v0.0.0-20230501180843-c9f554d75773
3.20.2

Open the chart page →

4,763
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
helm.sh/helm/v3@v0.0.0-20241216182912-7877b45b63f9
3.20.2

Open the chart page →

20,204
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
kubeoperator/webkubectl:v2.4.0be8f0d624640
helm.sh/helm/v3@v3.2.0
3.20.2

Open the chart page →

26,356
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
helm.sh/helm/v3@v3.9.3
3.20.2

Open the chart page →

4,271
linkerd-preview-vizlinkerd-buoyantVerified publisher25.4.33 of 5See more

linkerd-preview-viz linkerd-buoyant 25.4.3

3 of the 5 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/buoyantio/metrics-api:preview-25.4.32cef2a3f97da
helm.sh/helm/v3@v3.17.2
3.20.2
ghcr.io/buoyantio/tap:preview-25.4.3e02a8bd9e2c3
helm.sh/helm/v3@v3.17.2
3.20.2
ghcr.io/buoyantio/web:preview-25.4.33ee1b62aa111
helm.sh/helm/v3@v3.17.2
3.20.2

Open the chart page →

3,420
devpod-proloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
helm.sh/helm/v3@v0.0.0-20240205060548-90a52fb06c21
3.20.2

Open the chart page →

3,225
devspace-cloudloftVerified publisher0.3.31 of 8See more

devspace-cloud loft 0.3.3

1 of the 8 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
devspacecloud/manager:0.3.349c397413f7b
helm.sh/helm/v3@v3.1.0
3.20.2

Open the chart page →

9,880
loft-agentloftVerified publisher3.2.41 of 1See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/agent:3.2.45c109914ff73
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.20.2

Open the chart page →

2,444
vcluster-control-planeloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
helm.sh/helm/v3@v0.0.0-20240205060548-90a52fb06c21
3.20.2

Open the chart page →

3,225
vcluster-headloftVerified publisher0.0.0-035ec6e1 of 2See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.20.2

Open the chart page →

1,269
vcluster-proloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2026-35206.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.20.2

Open the chart page →

5,085

Container images carrying it

207 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
helm.sh/helm/v3@v3.3.4
3.20.2
1
quay.io/solo-io/discovery:0.0.0-fork5b62aaade3c9
helm.sh/helm/v3@v3.6.3
3.20.2
1
quay.io/solo-io/gloo:0.0.0-fork9a6c84560d44
helm.sh/helm/v3@v3.6.3
3.20.2
1
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.20.2
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
helm.sh/helm/v3@v3.7.0
3.20.2
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
helm.sh/helm/v3@v3.18.4
3.20.2
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
helm.sh/helm/v3@v3.18.4
3.20.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.