CVE-2026-35205: helm Failing Open
CVSS: 8.4v4.0HighModified
AliasesCGA-3p9g-w3j5-f3j8CGA-3q2w-x3qc-h3gqCGA-72j4-9388-57c8CGA-7vpc-cw8v-pqfhCGA-8267-pqgf-936qCGA-8pgm-ghqg-mvpqCGA-9m78-9g46-9x5qCGA-cmvp-pp24-w986CGA-cq93-89vr-xf98CGA-gh8m-w427-927xCGA-hj82-94qv-jj73CGA-j42p-p62m-x927CGA-jrgr-mfm6-2v9wCGA-m3jc-72cg-m8x9CGA-m747-4m5h-j78vCGA-q662-83v4-rx6qCGA-q99h-25v8-f775CGA-qr2g-rf6p-5pccCGA-r89c-88hc-qcv3CGA-rh6c-p7rp-6xpwCGA-vm4m-pf8x-whrhCGA-vmr9-vqhv-vmxcCGA-vw92-4fq9-2399CGA-vx36-7c9w-c7q6GHSA-q5jf-9vfq-h4h7BIT-helm-2026-35205GO-2026-5566CGA-22rj-hh8x-9chhCGA-4hrg-q42f-crr8CGA-4hvh-r234-297qCGA-4xxc-9c9v-9x99CGA-5v4p-4f5w-vpqcCGA-6355-p34r-5f6jCGA-668r-qc8v-6pc2CGA-c5hh-w9mh-xc2pCGA-c8vh-2chh-xcq4CGA-f5gp-9prh-j29hCGA-hcjw-wg8w-p3jvCGA-hv8g-mgjf-fvwcCGA-m595-8x83-hg7hCGA-mfqj-x4jq-g6j7CGA-pjh9-w8gp-v364CGA-qw9c-hmhw-gwpfCGA-r72m-54h4-qqp6CGA-rw4r-fp7v-r39wCGA-wvgx-c2q3-4x2pCGA-wvmw-cw63-h346CGA-x2jg-8qfg-jvh2
Published 09-04-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-35205 is a high (CVSS 8.4) Failing Open vulnerability in helm. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.5% of scored vulnerabilities.
CVSS score
8.4/10
010
High · v4.0 (CVE.org)EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 8Timeline
- 09-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
CVSS metrics
8 scores · 5 sources · 2 versionsHigh 8.4Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated8.4HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated8.4HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.4HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.4HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HSources3 sources · 7.8–8.0
- OSV · GoEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
0.00 pp
From 0.22% on 21-09-2026
21-09-202621-10-2026
EPSS score0.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-636Not Failing Securely ('Failing Open')When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Chainguard22 products
- cert-manager-cmctl< 2.4.1-r5
- cert-manager-cmctl-fips< 2.4.1-r5
- cilium-cli< 0.19.2-r10
- flux-2.8< 2.8.5-r2
- flux-fips-2.8< 2.8.8-r2
Wolfi11 products
- cert-manager-cmctl< 2.4.1-r5
- cilium-cli< 0.19.2-r10
- flux-2.8< 2.8.5-r2
- flux-source-controller< 1.8.2-r4
- helm-push< 0.11.1-r8
Helm1 product
- helm≥ 4.0.0, < 4.1.4
Helm.sh/helm1 product
- v4≥ 4.0.0, < 4.1.4
4 vendors · 35 products
References
11 links- github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7X Refsource CONFIRMAdvisoryWEBMitigationVendor Advisory
Show all 11 references
- github.com/helm/helmPACKAGE