Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Weakness
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Helm | Helm | 4.0.0 (including) | 4.1.4 (excluding) |
| Helm CLI 4.1 | RedHat | helm-cli-4.1.4 | * |
Potential Mitigations
References
- https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f
- https://github.com/helm/helm/releases/tag/v4.1.4
- https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7
- https://helm.sh/docs/topics/provenance/#the-provenance-file
- https://access.redhat.com/errata/RHSA-2026:26441
- https://access.redhat.com/security/cve/CVE-2026-35205
- https://bugzilla.redhat.com/show_bug.cgi?id=2456927
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35205.json