CVE-2026-35206: 
Helm vulnerability analysis and mitigation

CVE-2026-35206 is a path traversal vulnerability in Helm, the Kubernetes package manager, caused by improper handling of POSIX dot-segment chart names during chart extraction. A specially crafted Chart.yaml with a name set to . or .. causes helm pull --untar to write chart contents directly into the output directory (e.g., the current working directory) rather than the expected subdirectory named after the chart, potentially overwriting existing files. The vulnerability affects Helm versions ≤3.20.1 and ≤4.1.3 (v4 series from 4.0.0). It was disclosed on April 9, 2026, and carries a CVSS v4.0 base score of 4.8 (Medium) and a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). When Helm's Expand() function processes a chart archive, it uses the chart name from Chart.yaml to construct the extraction subdirectory path via SecureJoin. A chart name of . causes SecureJoin to resolve to the extraction root directory itself rather than a unique subdirectory, collapsing <output dir>/<chart name>/ to <output dir>/. The fix adds explicit rejection of chart names equal to . or .., and adds a defense-in-depth check ensuring the resolved chart directory is never identical to the extraction root (GitHub Commit, GitHub Advisory). Exploitation requires user interaction — a victim must run helm pull --untar against a maliciously crafted chart — and the attack vector is local, meaning the attacker must be able to supply or influence the chart being pulled.

Successful exploitation allows an attacker to overwrite arbitrary files within the targeted output directory (defaulting to the current working directory) by placing chart contents directly there instead of in a named subdirectory. This results in low integrity impact (unauthorized file overwrites) and low availability impact (potential disruption of files in the working directory), with no confidentiality impact. The scope is limited to the extraction directory and does not allow traversal beyond it, as dot-dot sequences in chart names are separately blocked (GitHub Advisory, Github Advisory). IBM Instana Observability is also identified as an affected downstream product (IBM Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-35206. The EPSS score is approximately 0.013% (0th percentile), indicating a very low probability of near-term exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must pull and untar a malicious chart), limiting its practical attack surface. The vulnerability was discovered and reported by researcher Oleh Konko (@1seal) (GitHub Advisory).

1. Craft a malicious chart: Create a Helm chart archive where Chart.yaml sets the name field to . (a single dot), which is a POSIX dot-segment that resolves to the current directory.
2. Package and host the chart: Package the malicious chart as a .tgz archive and host it on a web server or Helm chart repository accessible to the target.
3. Social engineering: Convince a victim using a vulnerable Helm version (≤3.20.1 or ≤4.1.3) to run helm pull --untar <malicious chart URL> or helm pull --untar <repo/chartname> pointing to the crafted chart.
4. Trigger directory collapse: When the victim executes the command, Helm's Expand() function resolves the chart name . via SecureJoin, causing the extraction root and chart directory to be identical, and writes all chart file contents directly into the output directory (e.g., the current working directory) instead of a subdirectory.
5. Overwrite target files: Chart files with attacker-controlled names are written directly into the output directory, potentially overwriting existing files such as configuration files, scripts, or other artifacts present in that directory (GitHub Advisory, GitHub Commit).

• File System: Unexpected files appearing directly in the working directory (or the directory specified by --destination/--untardir) after a helm pull --untar operation, rather than inside a named chart subdirectory; files with names matching chart template files (e.g., Chart.yaml, values.yaml, templates/) present at the root of the output directory.
• Logs: Helm CLI output or logs showing extraction of a chart with name . or ..; absence of a named subdirectory after chart extraction where one is expected.
• Process: Execution of helm pull --untar followed by unexpected modification timestamps on files in the working directory.

Upgrade Helm to version 3.20.2 or 4.1.4, which reject chart names equal to . or .. and enforce that the resolved chart directory is always a subdirectory of the extraction root (GitHub Advisory, Helm v4.1.4 Release). As a workaround for those unable to upgrade immediately: verify that chart names do not contain POSIX special directory references (. or ..) before running helm pull --untar, and always specify a unique, empty output directory via --destination/--untardir to prevent inadvertent overwriting of existing files. IBM Instana Observability users should refer to the IBM security bulletin for guidance on affected container image versions (IBM Advisory).

The vulnerability was reported by security researcher Oleh Konko (@1seal) and acknowledged by the Helm maintainers in the official GitHub Security Advisory (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assessed it as medium severity (Red Hat Bugzilla). OpenSUSE issued security announcements for their distributions, and IBM published a security bulletin for affected Instana Observability products (IBM Advisory). General community reaction has been measured given the moderate severity and the requirement for user interaction to exploit.