Hello Kubernetes Community, A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with config.enableHelm: true, and an authorized user has previously accessed the Helm functionality.
This issue has been rated High (8.8) ( CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H <https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>), and assigned CVE-2025-14269 Am I vulnerable? Kubernetes clusters with an in-cluster installation of Headlamp <= v0.38.0 and config.enableHelm set to true are affected. The Headlamp desktop version is not affected. Affected Versions - Headlamp <= v0.38.0 How do I mitigate this vulnerability? Upgrade to the fixed version. Prior to upgrading, this vulnerability can be mitigated by ensuring Headlamp is not publicly exposed with an ingress server to limit exposure. Fixed Versions - Headlamp v0.39.0 https://github.com/kubernetes-sigs/headlamp/releases/tag/v0.39.0 To upgrade, refer to the documentation: https://headlamp.dev/docs/latest/ Detection Review logs for unexpected access to clusters/main/helm/releases/list and other Helm related endpoints. If you find evidence that this vulnerability has been exploited, please contact [email protected] Additional Details See the GitHub issue for more details: https://github.com/kubernetes-sigs/headlamp/issues/4282 Acknowledgements This vulnerability was reported by brndstrp <https://hackerone.com/brndstrp> . Thank You, Craig Ingram on behalf of the Kubernetes Security Response Committee
