PT-2026-31624 · Helm+1 · Helm+1

CVE-2026-35205 · Published 2026-04-09 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Helm versions 4.0.0 through 4.1.3

Description Helm, a package manager for Kubernetes Charts, versions 4.0.0 through 4.1.3 do not install plugins with provenance files (.prov file) when signature verification is required. This impacts the integrity and security of installed plugins.

Recommendations Update to Helm version 4.1.4 or later.

Exploit

Fix

DoS

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-636

CWE-347

Related Identifiers

BDU:2026-07345

BIT-HELM-2026-35205

CLEANSTART-2026-WO11084

CVE-2026-35205

GHSA-Q5JF-9VFQ-H4H7

GO-2026-5566

OPENSUSE-SU-2026:10538-1

Affected Products

Helm

Red Os

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35205.json · Exploit
• https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f · Patch
• https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35204 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32280 · Security Note
• https://access.redhat.com/errata/RHSA-2026:26441 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35205 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07345 · Security Note
• https://osv.dev/vulnerability/GHSA-q5jf-9vfq-h4h7 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10538-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-helm-2026-35205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35205 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-WO11084 · Vendor Advisory