CVE-2026-35206 is a path traversal vulnerability in Helm's helm pull --untar command. An attacker can supply a specially crafted Chart that causes files to be written outside the intended directory, potentially overwriting critical files or placing malicious files in accessible locations. This can compromise data integrity and availability by modifying or corrupting files used by the system or security mechanisms. Red Hat Advanced Cluster Management for Kubernetes 2.13 images are affected. Red Hat has issued updated container images in version 2.13.9 as a security update to fix this vulnerability. The vulnerability is tracked under multiple CWEs including CWE-22 (Path Traversal) and others related to integrity and availability impacts. No known exploits in the wild have been reported. Red Hat provides official advisories and guidance for applying the update.

The vulnerability allows an attacker to write files outside the intended directory during the helm pull --untar operation, which can overwrite or create critical files. This can lead to unauthorized code execution, bypass of security mechanisms, exposure of sensitive data, or denial of service by corrupting important files. The impact affects integrity and availability of the system. Red Hat rates this vulnerability as high severity. No active exploitation has been reported.

Red Hat has released updated container images in Red Hat Advanced Cluster Management for Kubernetes version 2.13.9 that address this vulnerability. Users should apply this security update after ensuring all previously released relevant errata are applied. Detailed instructions for applying the update are available in the Red Hat advisory and documentation. There are no indications that additional mitigations are required beyond applying the official update.