Security: helm.sh/helm/v3 v3.20.2 brings in oras-go v2.6.0 with 4 CVEs

[qwer12314]

Vulnerability Report

exsctl v0.229.0 bundles helm.sh/helm/v3 v3.20.2 which transitively introduces oras.land/oras-go/v2 v2.6.0 — four published CVEs:

• CVE-2026-50151 HIGH Bearer token leaked via cross-host redirect
• CVE-2026-50163 HIGH Hardlink path traversal exposing credentials
• CVE-2026-48978 MEDIUM SSRF via WWW-Authenticate Bearer realm
• CVE-2026-50162 MEDIUM Symlink traversal write outside workingDir

Fix: bump helm to v3.21.3 (uses oras-go v2.6.1).

[github-actions]

Hello qwer12314 👋 Thank you for opening an issue in eksctl project. The team will review the issue and aim to respond within 1-5 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website