CVE-2026-35205
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Apr 9, 2026
CISA due date
—
The record
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | helm | 0 | 4.1.4-2.1 |
Related vulnerabilities
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects helm
- CVE-2026-41888 Distribution is a toolkit to pack, ship, store, and deliver container content. Also affects helm
- CVE-2026-33814 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing… Also affects helm
- CVE-2026-35206 Helm is a package manager for Charts for Kubernetes. Also affects helm
- CVE-2026-35204 Helm is a package manager for Charts for Kubernetes. Also affects helm
- CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
- CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636
- CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-636