CVE-2025-14269

CVE-2025-14269 在 Headlamp 的集群内版本中发现了一个安全问题，未经身份验证的用户可能能够重用缓存的凭证，通过 Headlamp UI 访问 Helm 功能。仅当 Headlamp 已安装、配置了 config.enableHelm: true，并且授权用户先前访问过 Helm 功能时，Kubernetes 集群才会受到影响。 PoC 安装 Headlamp 版本 = v0.38.0 配置 config.enableHelm: true 登录用户必须打开 Helm 页面（/clusters/main/helm/releases/list），之后响应将被缓存...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: k9s, rancher-agent, falcoctl, cloudbeat, rancher, tigera-operator, k9s-fips, kubescape-server, kyverno-fips, kgateway, drone-fips, vcluster, ratify-fips, consul-k8s, helm-exporter, kyverno-notation-aws-fips, linkerd2-fips, eksctl, rancher-fleet, xeol, helm-push,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: flux, k8sgpt, pluto, helm-set-status, trivy-operator, kots, cerbos, zot, flux-helm-controller, linkerd2, chart-testing, helm-operator, nova, flux-source-controller, zarf, envoy-gateway, eksctl, chartmuseum, headlamp, k9s, rancher-fleet, cert-manager-cmctl, kubescape,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: argo-events, pluto, rancher-system-agent, terraform-provider-azapi, k3s, nats-server-config-reloader, conftest, nri-memcached, src, neuvector-sigstore-interface, aws-privateca-issuer, kubernetes-csi-external-health-monitor, chart-testing, ipfs-cluster,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, kubevela, k9s, livekit-cli, rancher-agent, helm-fips, cloudbeat, rancher, amazon-ecs-agent-fips, tigera-operator, k9s-fips, buildkitd, newrelic-infrastructure-agent-fips, kubescape-server, kgateway, chainctl, consul-k8s, syft, helm-exporter,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, kubevela, k9s, livekit-cli, rancher-agent, helm-fips, cloudbeat, rancher, amazon-ecs-agent-fips, tigera-operator, k9s-fips, buildkitd, newrelic-infrastructure-agent-fips, kubescape-server, kgateway, chainctl, consul-k8s, syft, helm-exporter,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: tigera-operator, k8sgpt, kube-arangodb, helm-set-status, k3s, buildkitd, ctop, newrelic-infrastructure-agent, rancher-helm, dagger, gogatekeeper, grype, osv-scanner, teleport, trivy-operator, skaffold, kots, zot, kubevela, kubescape-operator, linkerd2,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, kubevela, k9s, livekit-cli, rancher-agent, helm-fips, cloudbeat, rancher, amazon-ecs-agent-fips, tigera-operator, k9s-fips, buildkitd, newrelic-infrastructure-agent-fips, kubescape-server, kgateway, chainctl, consul-k8s, syft, helm-exporter,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: cilium, tigera-operator, terraform-provider-kubernetes, argo-cd, k8sgpt, kube-arangodb, k3s, kpt, falcoctl, trivy-operator, jitsucom-bulker, teleport, cri-tools, skaffold, kots, aws-node-termination-handler, postgres-operator, kubevela, cert-manager-istio-csr,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: cilium, tigera-operator, terraform-provider-kubernetes, argo-cd, k8sgpt, kube-arangodb, k3s, kpt, falcoctl, trivy-operator, jitsucom-bulker, teleport, cri-tools, skaffold, kots, aws-node-termination-handler, postgres-operator, kubevela, cert-manager-istio-csr,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: flux, tigera-operator, pluto, kube-arangodb, helm-set-status, trivy-operator, kots, cerbos, zot, linkerd2, chart-testing, helm-operator, nova, flux-source-controller, zarf, eksctl, envoy-gateway, consul-k8s, chartmuseum, headlamp, k9s, rancher-fleet,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: flux, tigera-operator, pluto, kube-arangodb, helm-set-status, trivy-operator, kots, cerbos, zot, linkerd2, chart-testing, helm-operator, nova, flux-source-controller, zarf, eksctl, envoy-gateway, consul-k8s, chartmuseum, headlamp, k9s, rancher-fleet,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: eksctl, harbor, helm-docs, kubescape-server-fips, headlamp-fips, rancher-fleet, flux-fips, helm-operator, helm-push, trivy, zarf-fips, kots, nova-fips, trivy-fips, linkerd2, zot, teleport, cloudbeat-fips, kube-arangodb, k9s, istio, pluto,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: sops, terraform-provider-grafana, op-geth, argo-events, grafana-mimir, rancher-system-agent, cadvisor, kserve, pulumi-language-dotnet, crossplane-provider-aws-route53, k3s, snyk-cli, descheduler, newrelic-infrastructure-agent, dagger, grype, teleport, kuberay-operato...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: argo-events, trident, crossplane-provider-terraform-fips, azuredisk-csi, crossplane-provider-aws-opensearchserverless, snyk-cli, tekton-chains-fips, azcopy-fips, thanos, secrets-store-csi-driver-provider-azure, ceph-csi-operator, cortex, istio-fips,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: argo-events, trident, crossplane-provider-terraform-fips, azuredisk-csi, crossplane-provider-aws-opensearchserverless, snyk-cli, tekton-chains-fips, azcopy-fips, thanos, secrets-store-csi-driver-provider-azure, ceph-csi-operator, cortex, istio-fips,...

📄 Headlamp 0.38.0 Unauthenticated Cached Credentials Access

Proof of concept exploit for a flaw in Headlamp Kubernetes dashboard versions 0.38.0 and below that allows unauthenticated users to access sensitive Helm release data, including secrets, tokens, and passwords, due to improper server-side caching...

📄 Headlamp 0.38.0 Credential Reuse

A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with config.enableHelm: tru...

Credential caching in Headlamp with Helm enabled

Original tracking issue: https://github.com/kubernetes-sigs/headlamp/issues/4282 CVSS Rating: High 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Description of vulnerability A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse...

PT-2025-52206

Name of the Vulnerable Software and Affected Versions Headlamp versions prior to 0.39.0 Description A configuration issue with config.enableHelm: true in the Headlamp user interface for Kubernetes cluster management leads to information disclosure through caching when processing the...