CVE-2026-35205

CVE-2026-35205 is a vulnerability in Helm (a Kubernetes package manager) affecting versions 4.0.0 through 4.1.3, where the application fails to validate provenance files (.prov files) and will install plugins even when signature verification is required. This allows malicious or tampered plugins to be installed without proper authentication checks. The vulnerability has been remediated in version 4.1.4. The vulnerability carries a HIGH severity rating (CVSS 7.8) with a local attack vector requiring user interaction but no special privileges, making it accessible to standard users. The impact is significant, with potential for high-level compromise of confidentiality, integrity, and availability of affected systems. An attacker could exploit this to install malicious plugins with full system capabilities. There is currently no evidence of active exploitation in the wild, as indicated by its KEV (Known Exploited Vulnerabilities) status and inactive Hot List designation. The EPSS probability score of 0.00018 suggests minimal exploitation likelihood compared to other known vulnerabilities. Organizations should prioritize upgrading to version 4.1.4, though immediate risk appears low given the current threat landscape.