Description

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-12T16:17:14.383Z",
  "pubdate": "2026-08-12T16:17:14.383Z",
  "executiveSummary": "This vulnerability involves the inadvertent retention of sensitive cryptographic material within rendered deployment artifacts under specific self-hosted Helm configurations.\nSpecifically, generated TLS private keys are persisted within rendered Kubernetes manifests, creating a significant security risk for affected systems and products.\nThe primary impact of this issue is the unauthorized disclosure of cryptographic secrets, which can compromise the confidentiality and integrity of encrypted communications and cluster workloads.\nThe risk implications include potential man-in-the-middle attacks, unauthorized service impersonation, and broader infrastructure compromise if these private keys are leveraged across multiple internal components.\nExploitation requires highly privileged local users who possess the necessary permissions to inspect rendered manifests, local storage, or deployment configurations where the output of Helm template rendering is stored or cached.\nNo remote network access is strictly required for exploitation, as the attack surface relies entirely on local authorization boundaries and access control misconfigurations within the self-hosted deployment environment.",
  "technicalDetails": "The root cause of the vulnerability stems from how specific self-hosted Helm configurations handle the generation and rendering of sensitive template values, such as TLS private keys, during the chart installation or upgrade lifecycle.\nWhen Helm processes templates containing cryptographic generation functions, the resulting sensitive material is written directly into the rendered Kubernetes manifests rather than being dynamically injected via secure out-of-band mechanisms like Kubernetes Secrets or external secret management systems.\nConsequently, these rendered manifests—which may persist on disk, within CI/CD runner workspaces, or inside cluster-side caching layers—contain plaintext private keys.\nThe vulnerable component is the Helm chart templating and rendering engine configuration, specifically instances where automated secret generation is coupled with insecure manifest storage or verbose logging.\nThe attack flow begins when an administrator or automated process triggers a Helm template rendering or deployment action using the insecure configuration.\nThe rendering engine generates the TLS private key and embeds it directly into the YAML-based manifest output.\nA local threat actor or process operating with highly privileged local access—such as read permissions to local deployment directories, Helm cache directories, or revision history stored in Kubernetes Secrets—can subsequently access the rendered manifests.\nBy inspecting these artifacts, the privileged local user extracts the plaintext TLS private key.\nIn terms of requirements, exploitation necessitates high local privileges, as standard unprivileged users typically lack access to cluster-level secrets, deployment history, or administrative filesystem paths on self-hosted runners or management nodes.\nThe network exposure is primarily local or confined to the administrative plane, as the vulnerability manifests as a static data leakage vector rather than an active remote network service flaw.\nPost-exploitation impact includes the ability for the malicious or compromised privileged local user to decrypt TLS traffic, forge certificates, or impersonate services protected by the exposed keys, leading to lateral movement and deeper infrastructure compromise."
}