PT-2026-31624 · Helm+1 · Helm+1

Published 2026-04-09 · Updated 2026-05-18 · CVE-2026-35205

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Helm versions 4.0.0 through 4.1.3

Description Helm, a package manager for Kubernetes Charts, versions 4.0.0 through 4.1.3 do not install plugins with provenance files (.prov file) when signature verification is required. This impacts the integrity and security of installed plugins.

Recommendations Update to Helm version 4.1.4 or later.

Fix

Weakness Enumeration

CWE-636

Related Identifiers

BDU:2026-07345

BIT-HELM-2026-35205

CLEANSTART-2026-WO11084

CVE-2026-35205

GHSA-Q5JF-9VFQ-H4H7

OPENSUSE-SU-2026:10538-1

Affected Products

Helm

Red Os

References · 34

• https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 · Vendor Advisory
• https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35205 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10538-1 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-WO11084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32280 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32289 · Security Note
• https://bdu.fstec.ru/vul/2026-07345 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35204 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://osv.dev/vulnerability/GHSA-q5jf-9vfq-h4h7 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-helm-2026-35205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32283 · Security Note