GHSA-q5jf-9vfq-h4h7

Source

https://github.com/advisories/GHSA-q5jf-9vfq-h4h7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-q5jf-9vfq-h4h7/GHSA-q5jf-9vfq-h4h7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q5jf-9vfq-h4h7

Aliases

Downstream

CGA (45)

MINI (7)

Published

2026-04-10T15:33:03Z

Modified

2026-09-10T03:51:02Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Details

Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required.

Impact

The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update.

Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code.

Patches

This issue has been patched in Helm v4.1.4

Installing/updating a plugin with missing provenance will error if signature verification is required.

Workarounds

Users may manually validate that a plugin archive is not missing provenance data (.prov file) before installation.

Database specific

{
    "cwe_ids":  [
        "CWE-636"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-10T15:33:03Z",
    "nvd_published_at":  "2026-04-09T16:16:27Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / helm.sh/helm/v4

Package

Name: helm.sh/helm/v4; View open source insights on deps.dev
Purl: pkg:golang/helm.sh/helm/v4

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

4.1.4

Database specific

last_known_affected_version_range

"<= 4.1.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-q5jf-9vfq-h4h7/GHSA-q5jf-9vfq-h4h7.json"