CVE Feed

    Dashboard / CVE / CVE-2026-35204

    CVE-2026-35204

    Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. To prevent this, validate that the plugin.yaml of the Helm plugin does not include a version: field containing POSIX dot-dot path separators ie. "/../". This vulnerability is fixed in 4.1.4.

    Published:Apr 9, 2026
    Last Modified:Apr 17, 2026
    EPS:Apr 9, 2026
    EPSS Score:0.00017
    CVSS Score:8.6

    Affected Products

    Vendor
    Helm
    Product
    Helm

    Exploits

    https://github.com/h3ck13r/CVE-2026-35204

    Related CVEs

    CVE-2026-63308 (CVSS 5.3) — Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines tem…
    CVE-2026-35206 (CVSS 4.8) — Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafte…
    CVE-2026-35205 (CVSS 8.4) — Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing pr…
    CVE-2025-55198 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and inde…
    CVE-2025-55199 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON S…
    CVE-2025-53547 (CVSS 8.5) — Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file alon…
    CVE-2025-32386 (CVSS 6.5) — Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be sig…
    CVE-2025-32387 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a d…
    CVE-2019-25210 (CVSS 6.5) — An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of…
    CVE-2024-26147 (CVSS 7.5) — Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variabl…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High