BIT-helm-2026-35205

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/helm/BIT-helm-2026-35205.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-helm-2026-35205
Aliases
Published
2026-04-13T05:40:35.063Z
Modified
2026-04-13T08:27:18.124238368Z
Summary
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Details

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:helm:helm:*:*:*:*:*:go:*:*"
    ]
}
References

Affected packages

Bitnami / helm

Package

Name
helm
Purl
pkg:bitnami/helm

Severity

  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.1.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/helm/BIT-helm-2026-35205.json"