Description (CNA)
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| helm / helm | affected >= 4.0.0, < 4.1.4 |
CWE
CWE-636
References
- https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7
- https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f
- https://github.com/helm/helm/releases/tag/v4.1.4
- https://helm.sh/docs/topics/provenance/#the-provenance-file
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a malicious plugin that lacks a provenance file. Even when signature verification is enabled, Helm would incorrectly install this unverified plugin, bypassing critical security checks. This could lead to arbitrary code execution within the Kubernetes environment, allowing an attacker to gain unauthorized control.