VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 3, 2024· Updated Sep 4, 2024

CVE-2019-25210

CVE-2019-25210

Description

An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Helm --dry-run outputs Kubernetes Secret values in plaintext, exposing sensitive data when CI/CD logs are visible to unauthorized parties.

The vulnerability in Helm through version 3.13.3 concerns the --dry-run flag used with helm install and helm upgrade. When these commands are executed with --dry-run, Helm generates and displays all chart manifests that would be sent to the Kubernetes API, including Kubernetes Secrets. The Secret values are rendered in plaintext as part of the manifest output, rather than being summarized or omitted [1][2][4]. This behavior was intentionally introduced in Helm 3, where Secrets are treated like any other Kubernetes manifest resource [2].

Exploitation occurs in environments where the output of a --dry-run execution is captured and visible to unauthorized individuals. For example, in CI/CD pipelines, the tool may log the entire --dry-run output to a build log accessible by multiple team members or external actors. An attacker with access to such logs can read the plaintext secret values. No special privileges are required beyond access to the logged output; the attack vector is the exposure of the generated manifests to an unintended audience [1][2][4].

The impact is the unauthorized disclosure of sensitive information contained in Kubernetes Secrets. This can include API keys, database passwords, certificates, or any other data stored as a Secret. Depending on the secrets exposed, an attacker could compromise connected services, gain elevated access, or pivot to further attacks within the Kubernetes cluster or external systems [2][4].

As of the publication of this CVE, the Helm project has rejected the classification of this behavior as a vulnerability. The maintainers state that the --dry-run functionality is intentionally designed to show all rendered manifests, including Secrets, and that removing this would break backward compatibility for users who depend on seeing these values during debugging [2]. The vendor recommends that users avoid using --dry-run in environments where the output may be exposed to unauthorized parties, or to implement measures to secure the output channel [2].

References
  1. NVD - CVE-2019-25210
  2. Response To CVE-2019-25210
  3. helm 3 shows secrets with --dry-run option in clear text

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
helm.sh/helm/v3Go
>= 3.0.0, <= 3.14.2—

Affected products

221

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.