oss-security - [kubernetes] CVE-2025-14269: Credential caching in Headlamp with Helm enabled

Follow @Openwall on Twitter for new release announcements and other news

Message-ID: <CAHXwHVxGkV0vhWR21H88YDqFvexj51-8MskSy+eMOHAUcEx70g@mail.gmail.com>
Date: Wed, 17 Dec 2025 12:01:14 -0500
From: Craig Ingram <cjingram@...gle.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2025-14269: Credential caching in Headlamp with Helm enabled

Hello Kubernetes Community,

A security issue was discovered in the in-cluster version of Headlamp where
unauthenticated users may be able to reuse cached credentials to access
Helm functionality through the Headlamp UI. Kubernetes clusters are only
affected if Headlamp is installed, is configured with config.enableHelm:
true, and an authorized user has previously accessed the Helm functionality.

This issue has been rated High (8.8) (
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
<https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>),
and assigned CVE-2025-14269
Am I vulnerable?

Kubernetes clusters with an in-cluster installation of Headlamp <= v0.38.0
and config.enableHelm set to true are affected. The Headlamp desktop
version is not affected.
Affected Versions

   -

   Headlamp <= v0.38.0

How do I mitigate this vulnerability?

Upgrade to the fixed version. Prior to upgrading, this vulnerability can be
mitigated by ensuring Headlamp is not publicly exposed with an ingress
server to limit exposure.
Fixed Versions

   -

   Headlamp v0.39.0
   https://github.com/kubernetes-sigs/headlamp/releases/tag/v0.39.0

To upgrade, refer to the documentation: https://headlamp.dev/docs/latest/
Detection

Review logs for unexpected access to clusters/main/helm/releases/list and
other Helm related endpoints.

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io
Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes-sigs/headlamp/issues/4282
Acknowledgements

This vulnerability was reported by brndstrp <https://hackerone.com/brndstrp>
.

Thank You,

Craig Ingram on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.