[Security Advisory] CVE-2025-14269: Credential caching in Headlamp with Helm enabled

1 view
Skip to first unread message

Craig Ingram

unread,
12:01 PM (3 hours ago) 12:01 PM
to kubernete...@googlegroups.com, d...@kubernetes.io, kubernetes-sec...@googlegroups.com, kubernetes-se...@googlegroups.com, distributors-announce

Hello Kubernetes Community,


A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with config.enableHelm: true, and an authorized user has previously accessed the Helm functionality.


This issue has been rated High (8.8) (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and assigned CVE-2025-14269

Am I vulnerable?

Kubernetes clusters with an in-cluster installation of Headlamp <= v0.38.0 and config.enableHelm set to true are affected. The Headlamp desktop version is not affected.

Affected Versions

  • Headlamp <= v0.38.0

How do I mitigate this vulnerability?

Upgrade to the fixed version. Prior to upgrading, this vulnerability can be mitigated by ensuring Headlamp is not publicly exposed with an ingress server to limit exposure.

Fixed Versions


To upgrade, refer to the documentation: https://headlamp.dev/docs/latest/ 

Detection

Review logs for unexpected access to clusters/main/helm/releases/list and other Helm related endpoints.


If you find evidence that this vulnerability has been exploited, please contact secu...@kubernetes.io

Additional Details

See the GitHub issue for more details: https://github.com/kubernetes-sigs/headlamp/issues/4282

Acknowledgements

This vulnerability was reported by brndstrp.


Thank You,

Craig Ingram on behalf of the Kubernetes Security Response Committee


Reply all
Reply to author
Forward
0 new messages