Impact Score: 5/10
Helm 2.16.11
Source available — automated, not human-reviewed
Component: helm · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Helm v2.16.11. Source highlight: Helm v2.16.11 is a security (patch) release. Users are *strongly recommended* to update to this release. It fixes four notable security issues for which we have opened security advisories. More information on the security advisory can be found on the security advisory page.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (5)
- for discussing PRs, code, and bugs
- Test, debug, and contribute charts: GitHub/helm/charts
- fix formatting error (#8758) 73b28bab84490d18ab1b71489a574ee18e229eea (Matt Butcher)
- fix: use yaml annotations for yaml.v2 validation 077ffec4149aed43ba43942841473399afe4d3d1 (Matthew Fisher)
- backported fixes from helm3 6aab63765f99050b115f0aec3d6350c85e8da946 (Matt Butcher)
📄 View Raw Release Notes (Original Developer Log)
## v2.16.11
Helm v2.16.11 is a security (patch) release. Users are *strongly recommended* to update to this release. It fixes four notable security issues for which we have opened security advisories. More information on the security advisory can be found [on the security advisory page](https://github.com/helm/helm/security/advisories).
Most of the issues were discovered by [Trail of Bits](https://www.trailofbits.com/) during their CNCF-sponsored audit of the Helm codebase. We are grateful for Trail of Bits' detailed and thorough analysis of the Helm codebase. In addition, a Helm core maintainer identified one more issue.
The community keeps growing, and we'd love to see you there!
- Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com):
- for questions and just to hang out
- for discussing PRs, code, and bugs
- Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622)
- Test, debug, and contribute charts: [GitHub/helm/charts](https://github.com/helm/charts)
## Notable Changes
The main security issues are:
- [The plugin name field is not properly sanitized](https://github.com/helm/helm/security/advisories/GHSA-c52f-pq47-2r9j)
- [Alias names in Chart.yaml are not properly sanitized](https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776)
- [The index.yaml file for repositories is not parsed in strict mode, enabling duplicate entries](https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453)
- [The plugin.yaml file for repositories is not parsed in strict mode, enabling duplicate entries](https://github.com/helm/helm/security/advisories/GHSA-m54r-vrmv-hw33)
## Installation and Upgrading
Download Helm v2.16.11. The common platform binaries are here:
- [MacOS amd64](https://get.helm.sh/helm-v2.16.11-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-darwin-amd64.tar.gz.sha256) / e29337c497b481edd5fc436f04182ae7e939a4783a50bdd4b5a5a07eb60a810f)
- [Linux amd64](https://get.helm.sh/helm-v2.16.11-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-linux-amd64.tar.gz.sha256) / 7eeb6c01cd0f25223c885887669b57cebaf7a0552cff94c748f1c28e4df55ce2)
- [Linux arm](https://get.helm.sh/helm-v2.16.11-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-linux-arm.tar.gz.sha256) / d47dbb1bc0dfc18affb051d5b4a5eafe8f68f2717a84849e86af5425efd69ead)
- [Linux arm64](https://get.helm.sh/helm-v2.16.11-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-linux-arm64.tar.gz.sha256) / a6baba468b732823488e4e564ea4857d1f013a1b7e597a36e6118bc736173e33)
- [Linux i386](https://get.helm.sh/helm-v2.16.11-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-linux-386.tar.gz.sha256) / b3515890601bddce52db3c13a7c1bceca41904d2fa2375e5c11a2218ab0ca537)
- [Linux ppc64le](https://get.helm.sh/helm-v2.16.11-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-linux-ppc64le.tar.gz.sha256) / abb60635b042812a6997430d438c3cbde49e8816291608d5cbf835302001ae4c)
- [Linux s390x](https://get.helm.sh/helm-v2.16.11-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v2.16.11-linux-s390x.tar.gz.sha256) / e29337c497b481edd5fc436f04182ae7e939a4783a50bdd4b5a5a07eb60a810f)
- [Windows amd64](https://get.helm.sh/helm-v2.16.11-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v2.16.11-windows-amd64.zip.sha256) / e263f01a1e45a53aa9816aa8fc360bc8520cf448d7bf09fe30cca4e181acbe47)
This release was signed with `672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E ` and can be found at @mattfarina [keybase account](https://keybase.io/mattfarina). Please use the attached signatures for verifying this release using `gpg`.
The [Quickstart Guide](https://docs.helm.sh/using_helm/#quickstart-guide) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://docs.helm.sh/using_helm/#installing-helm). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3) on any system with `bash`.
## What's Next
- v2.17.0 will be the **LAST RELEASE** of Helm v2
## Changelog
- fix formatting error (#8758) 73b28bab84490d18ab1b71489a574ee18e229eea (Matt Butcher)
- fix: use yaml annotations for yaml.v2 validation 077ffec4149aed43ba43942841473399afe4d3d1 (Matthew Fisher)
- validate plugin metadata before loading c8d6b01d72c9604e43ee70d0d78fadd54c2d8499 (Matthew Fisher)
- backported fixes from helm3 6aab63765f99050b115f0aec3d6350c85e8da946 (Matt Butcher)
- Fixing broken vanity URL in dependencies a9337d8762e9191120126e088775c0b565c07667 (Matt Farina)