Database/Container, Kubernetes & orchestration
Helm: Crafted plugin writes its contents to an arbitrary filesystem location on install or update
CVSS 8.4CVE-2026-35204Container, Kubernetes & orchestrationcurated
Impact
Crafted plugin writes its contents to an arbitrary filesystem location on install or update
Who can reach it
Malicious Helm plugin
What to do
Upgrade Helm to 4.1.4+; restrict plugin sources
References
Related entries
- Helm: Helm installs plugins with no provenance file even when signature verification is requiredCVE-2026-35205 · HelmHigh
- Helm: Uninitialized variable panic parsing index and plugin YAMLCVE-2024-26147 · HelmHigh
- Helm: Helm repository credentials leaked to a redirected third-party hostCVE-2021-32690 · HelmMedium
- Helm: Path traversal in `helm fetch --untar` writes outside the target directoryCVE-2019-1000008 · HelmMedium
- Helm: OOM panic in the strvals package from crafted `--set` inputCVE-2022-36055 · HelmMedium
- Helm: Decompression bomb chart exhausts memory on the rendering hostCVE-2025-32386 · HelmMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.