# Helm Chart Template Injection via Unescaped .Values (YAML Injection in Kubernetes Manifests)

> Synacktiv research shows that unvalidated, user-controlled .Values inputs in Helm chart templates allow YAML injection (for example via multiline block scalars) that can alter existing Kubernetes resource specs or add entirely new resources. The risk is highest where developers control chart values while administrators control templates, notably in ArgoCD deployments. Helm 3 is injectable by default; Helm 4 (12 November 2025) narrows the attack via Server-Side Apply but still allows injecting new valid resources.

- **Published:** 2026-10-30T20:39:13Z
- **Last reviewed:** 2026-10-30T20:39:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4854
- **ID:** TL-2026-4854
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-24348, CVE-2022-31036

## Description

This is a class of misconfiguration/design weakness rather than a single product bug: no CVE or CVSS score has been assigned and the source does not report in-the-wild exploitation. Helm chart templates use Go templating, and values from .Values are frequently interpolated into YAML manifests without quoting, type casting or validation. If an attacker (or a low-privileged developer) controls those values, they can break out of the intended scalar and inject YAML structure.

Synacktiv (Paul Barbé), who encountered the issue during a Kubernetes cluster audit where a Helm chart was applied through ArgoCD, documents several injection primitives. (1) Multiline block-scalar injection using the YAML pipe operator, e.g. replicaCount set to '|\n  3\n    injectedAttribute: True', which adds attributes at the Deployment spec level. (2) Newline-stripping with '|-' to close a quoted string context, e.g. an image tag value of '1.0.0"' followed by a securityContext block with privileged: true, which yields a privileged container that bypasses the intent of Pod Security Admission. (3) Multi-document injection with the '---' separator to define entirely new resources such as a Namespace, Pods, Roles, ClusterRoles and ClusterRoleBindings outside the intended resource scope. (4) Context absorption using dummy resources to neutralise malformed YAML left over from the template. Injecting command and args fields gives arbitrary command execution within the container.

Helm 3 only renders the manifest and does not validate it against Kubernetes schemas, so unknown fields (e.g. spec.injectedAttribute) are silently accepted and injection succeeds by default. Helm 4 (released 12 November 2025 at KubeCon + CloudNativeCon North America) uses Server-Side Apply with strict field validation, so invalid attributes on existing resources fail with a schema validation error. Attackers can however still inject valid resource kinds through the document separator, so Helm 4 is only a partial mitigation. Per third-party release coverage, upgrades and rollbacks of releases originally created under Helm 3 keep the apply method the release was created with, so migrated estates may remain on client-side apply (secondary source; verify in your environment).

In ArgoCD, charts are deployed through the Application CRD. Multi-source setups intended to restrict developers to modifying values only remain exploitable when templates lack escaping: anyone with push privileges to the values repository can deploy arbitrary resources or workloads. The default ArgoCD configuration grants cluster-admin privileges, so impact is privilege escalation from a repo-write/values-only role to the privileges of the ArgoCD service account (often cluster-wide).

Mitigations documented in the source: use the quote function for strings and int/float64 casts for numbers, regexMatch plus fail for allow-listed formats, enforce values.schema.json (validated on helm template, install, upgrade and lint), restrict AppProject clusterResourceWhitelist, run ArgoCD namespace-scoped with Role/RoleBinding instead of a cluster-admin ClusterRole, and enforce Kubernetes Validating Admission Policies (CEL) such as denying privileged containers. Severity MEDIUM is an analyst estimate, not source-provided.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1610 Deploy Container
- T1609 Container Administration Command
- T1059 Command and Scripting Interpreter
- T1611 Escape to Host
- T1610 Deploy Container
- T1685 Disable or Modify Tools

## Sources

- [Charting your way in: Helm template injection (Synacktiv, Paul Barbé)](https://www.synacktiv.com/en/publications/charting-your-way-in-helm-template-injection.html)
- [Charting your way in - SSTIC 2026 slides (Synacktiv)](https://www.synacktiv.com/sites/default/files/2026-06/charting_your_way_in_sstic_2026.pdf)
- [CNCF - Helm marks 10 years with release of version 4](https://www.cncf.io/announcements/2025/11/12/helm-marks-10-years-with-release-of-version-4/)
- [Helm Docs - Charts: Schema Files (values.schema.json)](https://helm.sh/docs/topics/charts/#schema-files)
- [Helm Docs - Chart Template Guide](https://helm.sh/docs/chart_template_guide/)
- [Argo CD Docs - Projects (clusterResourceWhitelist)](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/)
- [Kubernetes Docs - Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/)
- [Apiiro - Malicious Kubernetes Helm charts can be used to steal sensitive information from Argo CD deployments (related prior research)](https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments)
- [CVE-2022-24348 - Argo CD Helm chart path traversal (related prior Argo CD/Helm issue)](https://db.fluidattacks.com/adv/go/github.com/argoproj/argo-cd/CVE-2022-24348)
- [CVE-2022-31036 - Argo CD symlinked Helm values files (related prior issue)](https://cveawg.mitre.org/api/cve/CVE-2022-31036)
- [CSA Research Note - Unpatched Argo CD Repo-Server Flaw Threatens AI/ML GitOps Pipelines (related separate Synacktiv finding)](https://labs.cloudsecurityalliance.org/research/csa-research-note-argocd-repo-server-rce-gitops-20260704-csa/)
- [ControlPlane - Argo CD repo server RCE (related separate Synacktiv finding)](https://control-plane.io/posts/argo-cd-repo-server-rce/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4854