EUVD-2026-20901
GHSA-q5jf-9vfq-h4h7
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Description
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Analysis
Signature verification bypass in Helm 4.0.0 through 4.1.3 allows installation of unverified plugins despite enabled provenance checking. When users require plugin signature verification, Helm incorrectly permits installation of plugins lacking provenance (.prov) files, enabling potential supply chain attacks where malicious code executes with Helm's privileges. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Inventory all Helm installations and identify systems running versions 4.0.0-4.1.3; disable Helm plugin installation capability via RBAC policies until patched. Within 7 days: Implement mandatory code review and signed artifact verification for all existing plugins; audit plugin installation logs for unauthorized additions. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today