HarborGuard / CVE
Back to search
HIGHCVE-2026-35205Published Modified CNA GitHub_M

CVE-2026-35205: Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

Metrics

CVSS v4.0
8.4
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • helm / helm
    >= 4.0.0, < 4.1.4
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References