CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: envoy-gateway, cilium-cli, kube-arangodb-fips, chart-testing-fips, chaos-mesh-fips, cluster-api-helm-controller-fips, gitlab-operator, headlamp-fips, helm-push, k8ssandra-client, kots, kuma, cluster-api-helm-controller, cerbos, teleport, flux-source-controller-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: external-secrets-operator, kubevirt-cdi-uploadserver, gomplate-fips, chezmoi, k8ssandra-client, azuredisk-csi, timoni, keda-fips, falcoctl, argo-workflows, amazon-ssm-agent, azuredisk-csi-fips, backup-restore-operator-fips, kube-arangodb, oras, amazon-ecs-agent,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, kubevirt-cdi-uploadserver, gomplate-fips, chezmoi, k8ssandra-client, azuredisk-csi, timoni, keda-fips, falcoctl, argo-workflows, amazon-ssm-agent, azuredisk-csi-fips, backup-restore-operator-fips, kube-arangodb, oras, amazon-ecs-agent,...

OPENSUSE-SU-2026:10532-1 helm3-3.20.2-1.1 on GA media

These are all security issues fixed in the helm3-3.20.2-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-35205

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a malicious plugin that lacks a provenance file. Even when signature verification is enabled, Helm would incorrectly install this unverified plugin, bypassing critical...

CVE-2026-35204

A flaw was found in Helm, a package manager for Kubernetes. An attacker could exploit this vulnerability by providing a specially crafted Helm plugin. When such a plugin is installed or updated, Helm incorrectly processes its configuration, allowing the plugin's contents to be written to an...

GHSA-HR2V-4R36-88HR Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions /, instead of the expected //, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes as if to refer to parent directories do not resolve beyond the...

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions /, instead of the expected //, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes as if to refer to parent directories do not resolve beyond the...

EUVD-2026-21100

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment...

Failing Open

Overview Affected versions of this package are vulnerable to Failing Open in plugin installation, when signature verification is required, but the .prov file is missing. An attacker can execute arbitrary code by providing a malicious plugin archive that omits provenance data, thereby bypassing...

Failing Open

Overview Affected versions of this package are vulnerable to Failing Open in plugin installation, when signature verification is required, but the .prov file is missing. An attacker can execute arbitrary code by providing a malicious plugin archive that omits provenance data, thereby bypassing...

Failing Open

Overview Affected versions of this package are vulnerable to Failing Open in plugin installation, when signature verification is required, but the .prov file is missing. An attacker can execute arbitrary code by providing a malicious plugin archive that omits provenance data, thereby bypassing...

GHSA-Q5JF-9VFQ-H4H7 Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Helm is a package manager for Charts for Kubernetes. In Helm versions =4.0.0 and =4.1.3, Helm will install plugins missing provenance .prov file when signature verification is required. Impact The bug allows plugin authors to omit provenance signing data from plugins, bypassing plugin signature...

Failing Open

Overview Affected versions of this package are vulnerable to Failing Open in plugin installation, when signature verification is required, but the .prov file is missing. An attacker can execute arbitrary code by providing a malicious plugin archive that omits provenance data, thereby bypassing...

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Helm is a package manager for Charts for Kubernetes. In Helm versions =4.0.0 and =4.1.3, Helm will install plugins missing provenance .prov file when signature verification is required. Impact The bug allows plugin authors to omit provenance signing data from plugins, bypassing plugin signature...

GHSA-VMX8-MQV2-9GMG Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

Helm is a package manager for Charts for Kubernetes. In Helm versions =4.0.0 and =4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. Impact A Helm user who installs or updates a plugin that is...

EUVD-2026-20900

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory...

CVE-2026-35206

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a specially crafted Chart to the helm pull --untar command. This would cause the Chart's contents to be written to an unintended directory, potentially overwriting existing...

OPENSUSE-SU-2026:10526-1 helm-4.1.4-1.1 on GA media

These are all security issues fixed in the helm-4.1.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-35206

Helm is a package manager for Charts for Kubernetes. In Helm versions =3.20.1 and =4.1.3, a specially crafted Chart will cause helm pull --untar chart URL | repo/chartname to write the Chart's contents to the immediate output directory as defaulted to the current working directory; or as given by...