Threat reportVulnerabilityTL-2026-4854
Helm Chart Template Injection via Unescaped .Values (YAML Injection in Kubernetes Manifests)
Helm Chart Template Injection via Unescaped .Values (YAML (TL-2026-4854), also tracked as Helm template injection, is a medium-severity software vulnerability, first published 2026-10-30. It has no confirmed attribution, affects Helm Helm CLI, references 2 CVEs (CVE-2022-24348, CVE-2022-31036), maps to 7 MITRE ATT&CK techniques (T1059, T1190, T1199), and is covered by 9 detection rules and 6 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4854
- Threat ID
- TL-2026-4854
- Also known as
- Helm template injection, Helm YAML injection, Charting your way in
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, finance, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in Helm Chart Template Injection via Unescaped .Values (YAML
Malware and tooling: Argo CD, Helm
How Helm Chart Template Injection via Unescaped .Values (YAML works
Synacktiv research shows that unvalidated, user-controlled .Values inputs in Helm chart templates allow YAML injection (for example via multiline block scalars) that can alter existing Kubernetes resource specs or add entirely new resources. The risk is highest where developers control chart values while administrators control templates, notably in ArgoCD deployments. Helm 3 is injectable by default; Helm 4 (12 November 2025) narrows the attack via Server-Side Apply but still allows injecting new valid resources.
This is a class of misconfiguration/design weakness rather than a single product bug: no CVE or CVSS score has been assigned and the source does not report in-the-wild exploitation. Helm chart templates use Go templating, and values from .Values are frequently interpolated into YAML manifests without quoting, type casting or validation. If an attacker (or a low-privileged developer) controls those values, they can break out of the intended scalar and inject YAML structure.
Synacktiv (Paul Barbé), who encountered the issue during a Kubernetes cluster audit where a Helm chart was applied through ArgoCD, documents several injection primitives. (1) Multiline block-scalar injection using the YAML pipe operator, e.g. replicaCount set to '|\n 3\n injectedAttribute: True', which adds attributes at the Deployment spec level. (2) Newline-stripping with '|-' to close a quoted string context, e.g. an image tag value of '1.0.0"' followed by a securityContext block with privileged: true, which yields a privileged container that bypasses the intent of Pod Security Admission. (3) Multi-document injection with the '---' separator to define entirely new resources such as a Namespace, Pods, Roles, ClusterRoles and ClusterRoleBindings outside the intended resource scope. (4) Context absorption using dummy resources to neutralise malformed YAML left over from the template. Injecting command and args fields gives arbitrary command execution within the container.
Helm 3 only renders the manifest and does not validate it against Kubernetes schemas, so unknown fields (e.g. spec.injectedAttribute) are silently accepted and injection succeeds by default. Helm 4 (released 12 November 2025 at KubeCon + CloudNativeCon North America) uses Server-Side Apply with strict field validation, so invalid attributes on existing resources fail with a schema validation error. Attackers can however still inject valid resource kinds through the document separator, so Helm 4 is only a partial mitigation. Per third-party release coverage, upgrades and rollbacks of releases originally created under Helm 3 keep the apply method the release was created with, so migrated estates may remain on client-side apply (secondary source; verify in your environment).
In ArgoCD, charts are deployed through the Application CRD. Multi-source setups intended to restrict developers to modifying values only remain exploitable when templates lack escaping: anyone with push privileges to the values repository can deploy arbitrary resources or workloads. The default ArgoCD configuration grants cluster-admin privileges, so impact is privilege escalation from a repo-write/values-only role to the privileges of the ArgoCD service account (often cluster-wide).
Mitigations documented in the source: use the quote function for strings and int/float64 casts for numbers, regexMatch plus fail for allow-listed formats, enforce values.schema.json (validated on helm template, install, upgrade and lint), restrict AppProject clusterResourceWhitelist, run ArgoCD namespace-scoped with Role/RoleBinding instead of a cluster-admin ClusterRole, and enforce Kubernetes Validating Admission Policies (CEL) such as denying privileged containers. Severity MEDIUM is an analyst estimate, not source-provided.
MITRE ATT&CK techniques used in TL-2026-4854
Execution
T1059 Command and Scripting Interpreter; T1609 Container Administration Command; T1610 Deploy Container
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
execution
Privilege Escalation
defense-impairment
Affected products and versions in Helm Chart Template Injection via Unescaped .Values (YAML
- Helm — Helm CLI
Vulnerable versions: 3.x (injection allowed by default)
Fixed in: 4.x (partial: Server-Side Apply rejects undeclared fields, but new valid resources can still be injected) - Argo Project — Argo CD (Helm-based Applications via Application CRD)
Vulnerable versions: Deployments applying charts with unescaped .Values, including multi-source values-only setups - Community — Helm charts interpolating .Values without quote, type casting or values.schema.json
Vulnerable versions: Any chart lacking escaping or schema validation
Remediation for Helm Chart Template Injection via Unescaped .Values (YAML
Patches
- No CVE or vendor patch: this is a template-authoring weakness. Helm 4 (12 November 2025) mitigates field injection on existing resources via Server-Side Apply
Immediate actions
- Audit Helm templates for .Values interpolated without quote, int or float64 casting, especially image tags, replica counts and free-text fields
- Review who has push rights to values repositories consumed by ArgoCD Applications and Helm releases
- Restrict AppProject clusterResourceWhitelist to the resource kinds a team legitimately deploys
Workarounds
- Use {{ printf "%s:%s" .Values.image.repository .Values.image.tag | quote }} for strings and {{ .Values.replicaCount | int }} for numbers
- Use regexMatch with fail to allow-list value formats in templates
- Do not pass --skip-schema-validation in pipelines
Longer-term hardening
- Ship a strict values.schema.json (types plus regex patterns) with every chart; it is enforced on helm template, install, upgrade and lint
- Run ArgoCD namespace-scoped with Role/RoleBinding rather than a cluster-admin ClusterRole
- Enforce Kubernetes Validating Admission Policies (CEL) to block privileged containers and other unsafe pod specs
- Migrate to Helm 4 so Server-Side Apply strict field validation rejects undeclared fields
CVEs associated with Helm Chart Template Injection via Unescaped .Values (YAML
Weaknesses (CWE) in Helm Chart Template Injection via Unescaped .Values (YAML
Timeline of Helm Chart Template Injection via Unescaped .Values (YAML
- Synacktiv reports a separate Argo CD repo-server unauthenticated RCE flaw to maintainers (January 2025, day not stated; per third-party coverage; context only, not the Helm injection issue)
- Helm v4.0.0 released at KubeCon + CloudNativeCon North America (Atlanta), the first major Helm release in six years, with Server-Side Apply and strict field validation that rejects undeclared fields on existing resources
- Companion SSTIC 2026 slides 'charting_your_way_in_sstic_2026.pdf' hosted by Synacktiv under the 2026-06 upload path
- Article publishes working injection payloads: multiline block-scalar attribute injection, privileged securityContext injection, command/args injection and multi-document Namespace/Pod/Role injection
- Synacktiv publishes 'Charting your way in: Helm template injection' (Paul Barbé), documenting YAML injection through unescaped .Values in Helm charts and ArgoCD deployments
- Synacktiv publishes a separate unauthenticated RCE in Argo CD repo-server (no CVE or fix at time of coverage); noted for context as the same research team and the same GitOps attack surface
- Cloud Security Alliance publishes a research note on the separate unpatched Argo CD repo-server flaw, highlighting GitOps pipeline risk
Sources cited for Helm Chart Template Injection via Unescaped .Values (YAML
- Charting your way in: Helm template injection (Synacktiv, Paul Barbé)
- Charting your way in - SSTIC 2026 slides (Synacktiv)
- CNCF - Helm marks 10 years with release of version 4
- Helm Docs - Charts: Schema Files (values.schema.json)
- Helm Docs - Chart Template Guide
- Argo CD Docs - Projects (clusterResourceWhitelist)
- Kubernetes Docs - Validating Admission Policy
- Apiiro - Malicious Kubernetes Helm charts can be used to steal sensitive information from Argo CD deployments (related prior research)
- CVE-2022-24348 - Argo CD Helm chart path traversal (related prior Argo CD/Helm issue)
- CVE-2022-31036 - Argo CD symlinked Helm values files (related prior issue)
- CSA Research Note - Unpatched Argo CD Repo-Server Flaw Threatens AI/ML GitOps Pipelines (related separate Synacktiv finding)
- ControlPlane - Argo CD repo server RCE (related separate Synacktiv finding)
Detection coverage for TL-2026-4854
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4854 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.