Most recent entries from all

bdu:2026-07345

BIT-helm-2026-35205 — Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Affected: Bitnami: helm

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

CLEANSTART-2026-KS65231 — Security fix for CVE-2026-35205 applied in: kumactl 2.13.4-r0

Affected: CleanStart: kumactl

Security vulnerability affects the kumactl package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-337293

fkie_cve-2026-35205

GHSA-q5jf-9vfq-h4h7 — Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Affected: Go: helm.sh/helm/v4

Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (`.prov` file) when signature verification is required.

### Impact

The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update.

Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code.

### Patches

This issue has been patched in Helm v4.1.4

Installing/updating a plugin with missing provenance will error if signature verification is required.

### Workarounds

Users may manually validate that a plugin archive is not missing provenance data (`.prov` file) before installation.

openSUSE-SU-2026:10538-1 — helm-4.1.4-2.1 on GA media

helm-4.1.4-2.1 on GA media

RHSA-2026:26441 — Red Hat Security Advisory: Helm CLI v4.1.4 release

github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart

WID-SEC-W-2026-1048 — helm: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in helm ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und potenziell um beliebigen Code auszuführen.