| Package | Affected versions | Patched versions |
|---|---|---|
| helm.sh/helm/v4 | ≥ 4.0.0, < 4.1.4 | 4.1.4 |
| helm | ≥ 4.0.0, < 4.1.4 | 4.1.4 |
Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required.
The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update.
Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code.
This issue has been patched in Helm v4.1.4
Installing/updating a plugin with missing provenance will error if signature verification is required.
Users may manually validate that a plugin archive is not missing provenance data (.prov file) before installation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free