{"action":"Upgrade helm.sh/helm/v4 to 4.1.4 or later.","affected":[{"fixed":"4.1.4","introduced":"4.0.0"}],"component":"helm.sh/helm/v4","cve_ids":["CVE-2026-35205"],"ecosystem":"Go","epss":0.00217,"exploited":false,"fixed_versions":["4.1.4"],"ghsa_id":"GHSA-q5jf-9vfq-h4h7","id":"tcs_01M5KGN8XXXCMK5WC78QNF31MY","modified_at":"2026-07-24T19:11:39.890512397Z","published_at":"2026-07-24T18:35:55Z","references":["https://osv.dev/vulnerability/GO-2026-5566","https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7","https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f","https://github.com/helm/helm/releases/tag/v4.1.4","https://helm.sh/docs/topics/provenance/#the-provenance-file"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GO-2026-5566","url":"https://osv.dev/vulnerability/GO-2026-5566"},{"source":"nvd","source_id":"CVE-2026-35205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35205"}],"summary":"Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm"}