CVE Feed

    Dashboard / CVE / CVE-2026-35205

    CVE-2026-35205

    Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

    Published:Apr 9, 2026
    Last Modified:Apr 17, 2026
    EPS:Apr 9, 2026
    EPSS Score:0.00018
    CVSS Score:7.8

    Affected Products

    Vendor
    Helm
    Product
    Helm

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-63308 (CVSS 5.3) — Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines tem…
    CVE-2026-35206 (CVSS 4.8) — Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafte…
    CVE-2026-35204 (CVSS 8.4) — Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, whe…
    CVE-2025-55198 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and inde…
    CVE-2025-55199 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON S…
    CVE-2025-53547 (CVSS 8.5) — Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file alon…
    CVE-2025-32386 (CVSS 6.5) — Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be sig…
    CVE-2025-32387 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a d…
    CVE-2019-25210 (CVSS 6.5) — An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of…
    CVE-2024-26147 (CVSS 7.5) — Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variabl…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High