high7.8
CVE-2026-35205
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Impact
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | helm.sh/helm/v4 | >= 4.0.0, <= 4.1.3 | 4.1.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Helm | Helm | from 4.0.0 before 4.1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-q5jf-9vfq-h4h7
- https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7
- https://nvd.nist.gov/vuln/detail/CVE-2026-35205
- https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f
- https://github.com/helm/helm/releases/tag/v4.1.4
- https://helm.sh/docs/topics/provenance/#the-provenance-file
- https://access.redhat.com/errata/RHSA-2026:26441
- https://access.redhat.com/security/cve/CVE-2026-35205
- https://bugzilla.redhat.com/show_bug.cgi?id=2456927
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35205.json