Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35205 Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is req… https://www.cve.org/CVERecord?id=CVE-2026-35205
Post summary
CVE-2026-35205 reveals that Helm 4.0.0‑4.1.3 can install plugins lacking provenance checks, compromising signature verification for Kubernetes charts.
CVE-2026-35205 Helm Plugin Installation Without Provenance Verification in Versions 4.0.0-4.1.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35205
Post summary
The entry announces CVE-2026-35205, detailing a lack of provenance verification for Helm plugin installations in versions 4.0.0‑4.1.3, with no additional PoC, exploit, patch, or exploitation information provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | helm | helm | - | - | - |