Helm versions from 4.0.0 up to but not including 4.1.4 have a vulnerability where plugin signature verification fails open if the provenance (.prov) file is missing. This allows installation of unsigned plugins even when signature verification is required. The issue is fixed in Helm version 4.1.4.