High severity · published Apr 9, 2026
CVE-2026-35205
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
helm · helm
>= 4.0.0, < 4.1.4 · source: vendor, NVD
HC
Helm CLI 4.1 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35205
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35205
Patch
https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f
Product
https://github.com/helm/helm/releases/tag/v4.1.4
Mitigation
https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7
Product
https://helm.sh/docs/topics/provenance/#the-provenance-file
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:26441
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-35205
More from helm
9.8
CVE-2019-18658
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive…
9.8
CVE-2019-1010275
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation
8.6
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
8.6
CVE-2025-53547
Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
8.6
CVE-2021-32690
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources)