CVE Feed

    Dashboard / CVE / CVE-2026-35206

    CVE-2026-35206

    Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

    Published:Apr 9, 2026
    Last Modified:Apr 16, 2026
    EPS:Apr 9, 2026
    EPSS Score:0.00017
    CVSS Score:4.4

    Affected Products

    Vendor
    Helm
    Product
    Helm

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-63308 (CVSS 5.3) — Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines tem…
    CVE-2026-35205 (CVSS 8.4) — Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing pr…
    CVE-2026-35204 (CVSS 8.4) — Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, whe…
    CVE-2025-55198 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and inde…
    CVE-2025-55199 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON S…
    CVE-2025-53547 (CVSS 8.5) — Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file alon…
    CVE-2025-32386 (CVSS 6.5) — Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be sig…
    CVE-2025-32387 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a d…
    CVE-2019-25210 (CVSS 6.5) — An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of…
    CVE-2024-26147 (CVSS 7.5) — Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variabl…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High