Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-35205US | high7.8 | — | ||
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vu… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2026:26441WEB
- https://access.redhat.com/security/cve/CVE-2026-35205WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2456927WEB
- https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074fFIX
- https://github.com/helm/helm/releases/tag/v4.1.4ARTICLE
- https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7ADVISORY
- https://helm.sh/docs/topics/provenance/#the-provenance-fileWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35205WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan