CVE-2026-35205

7.8

HIGHCVSS v3

Published

April 9, 2026

Affected

7 projects

Assigned by

GitHub

Severity scale

010

Description

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

helm/helm

GitHubThe Kubernetes Package Manager

>= 4.0.0, < 4.1.4NVD

corezoid/helm

GitHubCorezoid Helm Charts

>= 4.0.0, < 4.1.4NVD

helm

Python Package Index

More on this CVE

NVD↗GitHub Advisory↗

Helm is a system monitor released under GNU GPLv3.

>= 4.0.0, < 4.1.4NVD

Helm

NuGet GalleryHelm contains a .NET client which you can use to interact with Helm, the package manager for Kubernetes. It contains an client-side implementation of HAPI, the gRPC-based Helm API

>= 4.0.0, < 4.1.4NVD

helm

RubyGems Here's the idea, and it's very simple: you maintain a little database of the servers you work with. You have some commands you run parameterized in relationship to those servers. Those commands are all available as subcommands of helm.

>= 4.0.0, < 4.1.4NVD

helm

NPMA minimal hash router for browsers.

>= 4.0.0, < 4.1.4NVD

langchain-ai/helm

GitHubRepository hosting Langchain helm charts.

>= 4.0.0, < 4.1.4NVD

Security Advisories

CVE-2026-35205

Description

More on this CVE