CVE-2026-35205: Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

April 10, 2026 (updated April 24, 2026)

Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required.

References

github.com/advisories/GHSA-q5jf-9vfq-h4h7
github.com/helm/helm
github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f
github.com/helm/helm/releases/tag/v4.1.4
github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7
helm.sh/docs/topics/provenance/
nvd.nist.gov/vuln/detail/CVE-2026-35205

Code Behaviors & Features

Detect and mitigate CVE-2026-35205 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →