CVE-2026-35204: 
Helm vulnerability analysis and mitigation

CVE-2026-35204 is a path traversal vulnerability in Helm, the Kubernetes package manager, that allows a specially crafted plugin to write files to arbitrary filesystem locations during installation or update. It affects Helm versions 4.0.0 through 4.1.3 (inclusive) and was disclosed on April 9, 2026, with a patch released the same day in version 4.1.4. The vulnerability carries a CVSS v4 base score of 8.4 (High) and a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, Github Advisory).

The root cause is improper input validation (CWE-22: Path Traversal) in Helm's plugin metadata parsing logic. When Helm installs or updates a plugin, it uses the version field from the plugin's plugin.yaml file to construct filesystem paths for writing plugin content. Because Helm did not validate that the version field conformed to SemVer, an attacker could supply a value containing POSIX dot-dot path separators (e.g., ../../../../tmp/evil) to traverse outside the intended plugin directory and write files to arbitrary locations. The fix, applied in commit 36c8539, adds SemVer validation to the Validate() methods of Metadata, MetadataLegacy, and MetadataV1, rejecting any version string that is not valid SemVer (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files on the victim's filesystem with the permissions of the user running Helm, potentially including system binaries, configuration files, SSH authorized keys, or cron jobs. This can lead to complete system compromise, including high confidentiality, integrity, and availability impacts on subsequent systems. Because the attack requires the victim to install or update a malicious plugin, the direct impact is scoped to the user's environment, but lateral movement within a Kubernetes cluster or CI/CD pipeline is plausible if Helm is run with elevated privileges (GitHub Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013–0.018%, indicating a low near-term exploitation probability. Exploitation requires user interaction — specifically, a victim must install or update a malicious Helm plugin — which limits the attack surface to users who install plugins from untrusted or compromised sources.

1. Craft a malicious plugin: Create a Helm plugin repository containing a plugin.yaml with a version field set to a path traversal string, such as version: "../../../../home/user/.ssh/authorized_keys", and include a malicious file as the plugin content to be written.
2. Distribute the plugin: Host the malicious plugin on a public or attacker-controlled repository (e.g., a GitHub repo or a web server) and socially engineer the target into installing it, or compromise a legitimate plugin source.
3. Trigger installation: Convince the victim to run helm plugin install <malicious-plugin-url> or helm plugin update <plugin-name> on a Helm version between 4.0.0 and 4.1.3.
4. Achieve arbitrary file write: Helm processes the plugin.yaml, uses the traversal-laden version field to construct the destination path, and writes the plugin content to the attacker-specified location (e.g., overwriting ~/.ssh/authorized_keys with an attacker-controlled public key).
5. Escalate or persist: With the written file in place (e.g., an SSH key, a cron job, or a modified binary), the attacker gains persistent access or code execution on the victim's system (GitHub Advisory, GitHub Commit).

• File System: Unexpected files written outside the Helm plugin directory (typically ~/.helm/plugins/ or $HELM_PLUGINS), such as new or modified files in ~/.ssh/, /etc/cron.d/, /tmp/, or other sensitive directories; plugin directories with names containing .. or path separators.
• Logs: Helm CLI output or logs showing plugin installation from an unfamiliar or external source; errors or unexpected success messages during helm plugin install or helm plugin update referencing non-SemVer version strings (on unpatched versions).
• Process: Unexpected processes spawned after Helm plugin installation, particularly shells or network utilities initiated by newly installed plugin scripts.
• Configuration: plugin.yaml files within installed Helm plugins containing a version field with ../ or other path traversal sequences (GitHub Advisory).

Upgrade Helm to version 4.1.4 or later, which enforces SemVer validation on the plugin version field and rejects non-conforming values with an error (Helm v4.1.4 Release). As an interim workaround for users unable to upgrade immediately, manually inspect the plugin.yaml of any Helm plugin before installation and confirm the version field does not contain POSIX dot-dot path separators (/../ or ../). Additionally, only install Helm plugins from trusted, verified sources and review plugin configurations prior to installation (GitHub Advisory).

A Reddit post in the Kubernetes community (r/kubernetes) titled "PSA: Helm path traversal via malicious plugin" was noted shortly after disclosure, indicating community awareness of the issue. The vulnerability was credited to researcher maru1009 in the official advisory. The fix was bundled with two other security fixes in the Helm v4.1.4 release, suggesting a coordinated security patch cycle (Helm v4.1.4 Release, GitHub Advisory).