Attack Chain

1. An attacker crafts a malicious Helm plugin, omitting the .prov file to bypass signature verification.
2. The attacker distributes the malicious plugin through a compromised repository or social engineering.
3. A user attempts to install or update the plugin using helm plugin install or helm plugin update.
4. Due to the missing .prov file, Helm versions 4.0.0-4.1.3 skip signature verification.
5. The malicious plugin is installed successfully, despite lacking a valid signature.
6. The user interacts with the installed plugin or a Helm hook triggers execution of the plugin's code.
7. The malicious plugin executes arbitrary code on the Kubernetes cluster or the user's machine.
8. The attacker gains unauthorized access or control over the system, potentially leading to data exfiltration, resource compromise, or denial of service.

Impact

Successful exploitation of this vulnerability can lead to arbitrary code execution within a Kubernetes environment. The impact could range from data exfiltration and resource hijacking to complete compromise of the cluster. Given the widespread adoption of Helm in managing Kubernetes applications, a significant number of organizations are potentially vulnerable. The vulnerability affects versions 4.0.0 through 4.1.3, requiring users to upgrade to version 4.1.4 or later to mitigate the risk.

Recommendation

• Upgrade Helm to version 4.1.4 or later to patch CVE-2026-35205.
• Implement manual validation that a plugin archive contains provenance data (.prov file) before installation as a short-term workaround.
• Deploy the Sigma rule "Detect Helm Plugin Installation Without Provenance" to identify attempts to install plugins without .prov files.
• Monitor Helm plugin installation events for unexpected processes or network connections originating from plugin directories using the "Suspicious Process Execution from Helm Plugin Directory" Sigma rule.