VDB
Sign up
—

GO-2026-5566

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm

Quick fix

GO-2026-5566 — helm.sh/helm/v4: upgrade to the fixed version with the command below.

go get helm.sh/helm/v4@v4.1.4

Details

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/helm.sh/helm/v4
Introduced in: 4.0.0Fixed in: 4.1.4
Fixgo get helm.sh/helm/v4@v4.1.4

References