{"action":"Upgrade helm.sh/helm/v4 to 4.1.4 or later.","affected":[{"fixed":"4.1.4","introduced":"4.0.0"}],"component":"helm.sh/helm/v4","cve_ids":["CVE-2026-35205"],"ecosystem":"Go","epss":0.00217,"exploited":false,"fixed_versions":["4.1.4"],"ghsa_id":"GHSA-q5jf-9vfq-h4h7","id":"tcs_01M5KFJC2XZ24SGXGHWZBQH72Y","modified_at":"2026-09-10T03:51:02.705658582Z","published_at":"2026-04-10T15:33:03Z","references":["https://osv.dev/vulnerability/GHSA-q5jf-9vfq-h4h7","https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7","https://nvd.nist.gov/vuln/detail/CVE-2026-35205","https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f","https://github.com/helm/helm","https://github.com/helm/helm/releases/tag/v4.1.4","https://helm.sh/docs/topics/provenance/#the-provenance-file"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-q5jf-9vfq-h4h7","url":"https://osv.dev/vulnerability/GHSA-q5jf-9vfq-h4h7"}],"summary":"Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install"}