Helm CLI, the Kubernetes package manager, contains a vulnerability (CVE-2026-35204) where processing of specially crafted plugins allows arbitrary file writes to the filesystem. This occurs because Helm incorrectly handles plugin configuration, enabling an attacker to write or overwrite critical files. The vulnerability impacts integrity, confidentiality, and availability by potentially allowing unauthorized code execution, file modification, and denial of service. Red Hat released Helm CLI v4.1.4 binaries to address this issue. The vulnerability is associated with CWE-22 (Path Traversal) and CWE-347 (Improper Verification of Cryptographic Signature). No explicit patch for Red Hat products beyond the Helm CLI update is documented. The vulnerability has a high severity rating but no official CVSS score from Red Hat. No known exploits in the wild have been reported.

An attacker who can provide a specially crafted Helm plugin can cause Helm to write files to arbitrary locations on the filesystem. This can lead to unauthorized modification or creation of critical files, potentially enabling code execution, bypassing security mechanisms, or causing denial of service by corrupting important data or programs. The vulnerability affects the integrity, confidentiality, and availability of affected systems running vulnerable Helm CLI versions.

Red Hat recommends upgrading to Helm CLI version 4.1.4, which includes the fix for this vulnerability. The updated binaries are available from Red Hat's official mirror site. No other mitigation is currently available or meets Red Hat's criteria for ease of use and applicability. Users should replace vulnerable Helm CLI versions with the fixed 4.1.4 release to remediate this issue.