CVE-2019-1010275
Quick assessment
Affected
helm helm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
helm是一款Kubernetes包管理器。 helm 2.7.2之前版本中存在信任管理问题漏洞。该漏洞源于网络系统或产品中缺乏有效的信任管理机制。攻击者可利用默认密码或者硬编码密码、硬编码证书等攻击受影响组件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-1010275
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
helm 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
helm是一款Kubernetes包管理器。 helm 2.7.2之前版本中存在信任管理问题漏洞。该漏洞源于网络系统或产品中缺乏有效的信任管理机制。攻击者可利用默认密码或者硬编码密码、硬编码证书等攻击受影响组件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2019-1010275
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-1010275
请登录查看更多情报信息。
Patches & Fixes for CVE-2019-1010275 (1)
-
https://github.com/helm/helm/pull/3152 x_refsource_MISC
Other References for CVE-2019-1010275 (1)
-
https://github.com/helm/helm/releases/tag/v2.7.2 x_refsource_MISC
IV. Related Vulnerabilities
Same product: helm
-
CVE-2026-63308
Helm Files.Lines Denial of Service via Empty Chart Files -
CVE-2026-35206
Helm Chart extraction output directory collapse via `Chart.y -
CVE-2026-35205
Helm's plugin verification fails open when .prov is missing, -
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables -
CVE-2026-25750
LangSmith Studio has URL Parameter Injection Vulnerability t
Same vendor: helm
-
CVE-2026-63308
Helm Files.Lines Denial of Service via Empty Chart Files -
CVE-2026-35206
Helm Chart extraction output directory collapse via `Chart.y -
CVE-2026-35205
Helm's plugin verification fails open when .prov is missing, -
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables -
CVE-2025-55198
Helm May Panic Due To Incorrect YAML Content
Same weakness: CWE-295
-
CVE-2026-85088
Apache Thrift, Apache Thrift: The C++ and D clients fall bac -
CVE-2026-85087
Apache Thrift: Python ≥3.12 host-name check silently becomes -
CVE-2026-85086
Apache Thrift: Perl TLS client disables certificate verifica -
CVE-2026-80443
Insecure TLS Certificate Validation in API Tool Runner in HA -
CVE-2026-103602
Name constraints bypass via trailing dot in rfc822Name, dNSN
V. Comments for CVE-2019-1010275
No comments yet