CVE-2025-14269

CVE-2025-14269 Headlamp के क्लस्टर-इन संस्करण में एक सुरक्षा समस्या पाई गई है, जहाँ अप्रमाणित उपयोगकर्ता Headlamp UI के माध्यम से Helm कार्यक्षमता तक पहुँचने के लिए कैश्ड क्रेडेंशियल्स का पुन: उपयोग कर सकते हैं। Kubernetes क्लस्टर तभी प्रभावित होते हैं जब Headlamp स्थापित हो, config.enableHelm:...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: helm-push, oras-fips, kubescape-operator, cloudbeat, falcoctl, gitlab-operator, gogatekeeper, consul-k8s-fips, kyverno-notation-aws, ocm-cli-fips, ocm-kubernetes-controller, oras, kyverno-fips, kyverno-notation-aws-fips, argocd-image-updater, jfrog-cli,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, flux, linkerd2, headlamp, chart-testing, pluto, cerbos, zot, kubescape, envoy-gateway, cilium-cli, cluster-api-helm-controller, helm-push, trivy-operator, zarf, k9s, flux-source-controller, k8sgpt, k8ssandra-client, istio, helm-operator, eksctl,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: k8sgateway, guac, kubeflow-katib, envconsul, cni-plugins, kuberlr, nri-nginx, kapp, kubernetes-csi-external-health-monitor, kubernetes-csi-driver-nfs, ko, witness, prometheus, pluto, kubernetes-csi-driver-hostpath, fulcio, neuvector-sigstore-interface, migrate, wal-g...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: grype, helm-push, k3s, kubescape-operator, cloudbeat, docker-fips, kubevela, chainctl-fips, consul-k8s-fips, grype-fips, k8sgpt, jfrog-cli, chartmuseum-fips, tigera-operator, chaos-mesh-fips, trivy-operator-fips, grype-db, gitlab-rails-ce-fips, k9s-fips, syft, zarf,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: grype, helm-push, k3s, kubescape-operator, cloudbeat, docker-fips, kubevela, chainctl-fips, consul-k8s-fips, grype-fips, k8sgpt, jfrog-cli, chartmuseum-fips, tigera-operator, chaos-mesh-fips, trivy-operator-fips, grype-db, gitlab-rails-ce-fips, k9s-fips, syft, zarf,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, xeol, grype, linkerd2, headlamp, spegel, syft, kubescape, kaniko, rancher-helm, envoy-gateway, zot, docker-compose, rancher, steampipe, neuvector-scanner, cluster-api-helm-controller, helm-push, kubescape-operator, opa, tigera-operator, wolfictl,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: grype, helm-push, k3s, kubescape-operator, cloudbeat, gogatekeeper, docker-fips, kubevela, chainctl-fips, consul-k8s-fips, grype-fips, opa-envoy, k8sgpt, jfrog-cli, chartmuseum-fips, tigera-operator, chaos-mesh-fips, trivy-operator-fips, grype-db, gitlab-rails-ce-fip...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: sonobuoy, hubble, k8sgpt-operator, cluster-api, dynamic-localpv-provisioner, linkerd2, headlamp, postgres-operator, argo-rollouts, vcluster, verticadb-operator, argo-workflows, infinispan-operator, kubescape, envoy-gateway, gitlab-kas, cilium-cli, rancher,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: sonobuoy, hubble, k8sgpt-operator, cluster-api, dynamic-localpv-provisioner, linkerd2, headlamp, postgres-operator, argo-rollouts, vcluster, verticadb-operator, argo-workflows, infinispan-operator, kubescape, envoy-gateway, gitlab-kas, cilium-cli, rancher,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, flux, linkerd2, headlamp, harbor, chart-testing, pluto, cerbos, zot, kubescape, envoy-gateway, cilium-cli, tigera-operator, cluster-api-helm-controller, helm-push, trivy-operator, kuma, zarf, k9s, flux-source-controller, k8ssandra-client, istio,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, flux, linkerd2, headlamp, harbor, chart-testing, pluto, cerbos, zot, kubescape, envoy-gateway, cilium-cli, tigera-operator, cluster-api-helm-controller, helm-push, trivy-operator, kuma, zarf, k9s, flux-source-controller, k8ssandra-client, istio,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: nova, helm-exporter-fips, zarf, helm-mapkubeapis, kubescape-server, helm-push, flux-fips, chart-testing, helm-diff, kube-arangodb, linkerd2-fips, cluster-api-helm-controller, consul-k8s, pluto, cloudbeat, cerbos, gitlab-operator-fips, headlamp, gitlab-operator,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: trufflehog, k8sgateway, guac, xeol, amazon-cloudwatch-agent, grype, kapp, kubernetes-csi-external-health-monitor, podinfo, ko, fluent-operator, argo-rollouts, envoy-ratelimit, prometheus, secrets-store-csi-driver, kubernetes-csi-driver-hostpath, restic, argo-workflow...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: op-geth, prometheus-alertmanager-fips, metallb, pulumi-language-java, rke2-runtime-fips, crossplane-provider-aws-memorydb-fips, nginx-kubernetes-ingress, boring-registry, knative-operator-fips, cloudbeat, crossplane-provider-aws-kafkaconnect,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: op-geth, prometheus-alertmanager-fips, metallb, pulumi-language-java, rke2-runtime-fips, crossplane-provider-aws-memorydb-fips, nginx-kubernetes-ingress, boring-registry, knative-operator-fips, cloudbeat, crossplane-provider-aws-kafkaconnect,...

📄 Headlamp 0.38.0 Unauthenticated Cached Credentials Access

Proof of concept exploit for a flaw in Headlamp Kubernetes dashboard versions 0.38.0 and below that allows unauthenticated users to access sensitive Helm release data, including secrets, tokens, and passwords, due to improper server-side caching...

📄 Headlamp 0.38.0 Credential Reuse

A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with config.enableHelm: tru...

Credential caching in Headlamp with Helm enabled

Original tracking issue: https://github.com/kubernetes-sigs/headlamp/issues/4282 CVSS Rating: High 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Description of vulnerability A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse...

PT-2025-52206

Name of the Vulnerable Software and Affected Versions Headlamp versions prior to 0.39.0 Description A configuration issue with config.enableHelm: true in the Headlamp user interface for Kubernetes cluster management leads to information disclosure through caching when processing the...