CVE-2020-11013: 
Helm vulnerability analysis and mitigation

The vulnerability (CVE-2020-11013) is an information disclosure vulnerability discovered in Helm versions 3.1.0-3.1.2. The issue was identified by the Helm core maintainers and disclosed on April 22, 2020. The vulnerability affects the lookup template function introduced in Helm v3, which could allow unintended cluster access during template rendering operations (Helm Advisory).

The vulnerability stems from the lookup template function's behavior, which connects to the cluster during helm template and helm install|update|delete|rollback --dry-run operations without notifying the user. This behavior contradicts the documented functionality of helm template, which states it should not attach to a remote cluster. The issue was patched in versions 3.1.3 and 3.2.0 (Helm Advisory).

A malicious chart author could exploit this vulnerability by injecting a lookup function into a chart that, when rendered through helm template, performs unauthorized lookups against the cluster specified in a user's KUBECONFIG file. The retrieved information could then be exposed through the helm template output (Helm Advisory).

The vulnerability only impacts Helm 3.1.x versions, while Helm 2 and 3.0.x remain unaffected. The exploit requires a malicious chart to be processed using the helm template command, with the user having a valid KUBECONFIG file pointing to a cluster (Helm Advisory).

Several workarounds are available: running helm lint on untrusted charts (which will fail if the lookup function is present), setting KUBECONFIG to point to an empty configuration file, or manually analyzing chart templates for the presence of lookup functions. The vulnerability has been permanently fixed in Helm versions 3.1.3 and 3.2.0 (Helm Advisory).

The vulnerability was addressed promptly in the Helm v3.2.0 release, which included the security fix along with other feature improvements. The issue was treated as a low-severity security concern and was handled through proper disclosure channels (Helm Release).