CVE-2026-35205

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f	Patch
https://github.com/helm/helm/releases/tag/v4.1.4	Product Release Notes
https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7	Vendor Advisory Mitigation
https://helm.sh/docs/topics/provenance/#the-provenance-file	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*

History

17 Apr 2026, 14:05

Type	Values Removed	Values Added
CPE		cpe:2.3:a:helm:helm::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
First Time		Helm Helm helm
References	~~() https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f -~~	() https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f - Patch
References	~~() https://github.com/helm/helm/releases/tag/v4.1.4 -~~	() https://github.com/helm/helm/releases/tag/v4.1.4 - Product, Release Notes
References	~~() https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 -~~	() https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 - Vendor Advisory, Mitigation
References	~~() https://helm.sh/docs/topics/provenance/#the-provenance-file -~~	() https://helm.sh/docs/topics/provenance/#the-provenance-file - Product

09 Apr 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-09 16:16

Updated : 2026-04-17 14:05

NVD link : CVE-2026-35205

Mitre link : CVE-2026-35205

CVE.ORG link : CVE-2026-35205

JSON object : View

Products Affected

helm

helm

CWE

CWE-636

Not Failing Securely ('Failing Open')

{"id": "CVE-2026-35205", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-04-09T16:16:27.720", "references": [{"url": "https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/helm/helm/releases/tag/v4.1.4", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7", "tags": ["Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}, {"url": "https://helm.sh/docs/topics/provenance/#the-provenance-file", "tags": ["Product"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-636"}]}], "descriptions": [{"lang": "en", "value": "Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4."}], "lastModified": "2026-04-17T14:05:55.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "800B9949-E36B-45F3-9EA0-CA9DDA3D8868", "versionEndExcluding": "4.1.4", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}