RHSA-2026:26441HighCVSS 8.2
Red Hat Security Advisory: Helm CLI v4.1.4 release
🔗 CVE IDs covered (3)
📋 Description
CVE-2026-35204 — github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin CVE-2026-35205 — github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification CVE-2026-35206 — github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart
🎯 Affected products9
- Helm CLI 4.1
- helm-cli-4.1.4@amd64 as a component of Helm CLI 4.1
- helm-cli-4.1.4@amd64_darwin as a component of Helm CLI 4.1
- helm-cli-4.1.4@amd64_windows as a component of Helm CLI 4.1
- helm-cli-4.1.4@arm64 as a component of Helm CLI 4.1
- helm-cli-4.1.4@arm64_darwin as a component of Helm CLI 4.1
- helm-cli-4.1.4@arm64_windows as a component of Helm CLI 4.1
- helm-cli-4.1.4@ppc64le as a component of Helm CLI 4.1
- helm-cli-4.1.4@s390x as a component of Helm CLI 4.1
✅ Remediation
Download the Helm CLI v4.1.4 binaries for your platform from https://mirror.openshift.com/pub/cgw/helm/4.1.4/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
🔗 References (9)
- selfhttps://access.redhat.com/errata/RHSA-2026:26441
- externalhttps://access.redhat.com/security/cve/CVE-2026-35204
- externalhttps://access.redhat.com/security/cve/CVE-2026-35205
- externalhttps://access.redhat.com/security/cve/CVE-2026-35206
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://github.com/helm/helm/releases/tag/v4.1.4
- externalhttps://helm.sh/docs/
- externalhttps://mirror.openshift.com/pub/cgw/helm/4.1.4/
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26441.json