CVE-2026-35205
HIGHHelm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Title source: cnaDescription
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Scores
CVSS v3
7.8
EPSS
0.0002
EPSS Percentile
4.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-636
Status
published
Products (3)
helm/helm
4.0.0 - 4.1.4
helm/helm
>= 4.0.0, < 4.1.4
helm/v4
4.0.0 - 4.1.4Go
Published
Apr 09, 2026
Tracked Since
Apr 09, 2026