PT-2026-32427 · Bitnami · Helm

Published 2026-04-13 · Updated 2026-04-13

OSV

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

Related Identifiers

BIT-HELM-2026-35205

Affected Products

Helm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-35205 · Security Note
• https://osv.dev/vulnerability/BIT-helm-2026-35205 · Vendor Advisory
• https://github.com/helm/helm/releases/tag/v4.1.4 · Note
• https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 · Note
• https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f · Note
• https://helm.sh/docs/topics/provenance/#the-provenance-file · Note