CVE-2025-14269

CVE-2025-14269 Se descubrió un problema de seguridad en la versión dentro del clúster de Headlamp donde usuarios no autenticados pueden reutilizar credenciales en caché para acceder a la funcionalidad de Helm a través de la interfaz de usuario de Headlamp. Los clústeres de Kubernetes solo se ven...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: helm, tigera-operator-fips, conftest-fips, gitness, chartmuseum-fips, consul-k8s, chartmuseum, kubescape-server-fips, cilium-cli, linkerd2, rancher-fleet, crossplane, cluster-api-helm-controller, ratify-fips, envoy-gateway, steampipe, tw, kyverno-fips, argo-cd,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: zarf, cerbos, pluto, headlamp, kots, rancher-fleet, trivy-operator, envoy-gateway, k8ssandra-client, nova, eksctl, flux-source-controller, helm-push, chartmuseum, cilium-cli, k8sgpt, helm-mapkubeapis, kubescape, zot, helm-docs, trivy, chart-testing, helm-operator,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: src, cerbos, mockgen, kube-logging-operator, wal-g, pluto, oauth2-proxy, ip-masq-agent, kubecolor, kubeflow-katib, k3s, render-template, kubernetes-dashboard, docker-credential-gcr, nova, nri-apache, terraform, fulcio, helm-push, chartmuseum, cloud-provider-vsphere,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: helm, harvester-fips, tigera-operator-fips, buildkitd-fips, chainctl, chartmuseum-fips, consul-k8s, chartmuseum, docker-compose-fips, kubescape-server-fips, linkerd2, crossplane, falco-no-driver, cluster-api-helm-controller, google-osconfig-agent, kubevela-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: helm, harvester-fips, tigera-operator-fips, buildkitd-fips, chainctl, chartmuseum-fips, consul-k8s, chartmuseum, docker-compose-fips, kubescape-server-fips, linkerd2, crossplane, falco-no-driver, cluster-api-helm-controller, google-osconfig-agent, kubevela-fips,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: rancher-helm, zarf, buildkitd, steampipe, headlamp, kots, kubevela, spegel, ctop, rancher-agent, scorecard, k3s, trivy-operator, docker-cli-buildx, envoy-gateway, k8ssandra-client, dagger, manifest-tool, grype, eksctl, helm-push, chartmuseum, k8sgpt, docker,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: helm, tigera-operator-fips, buildkitd-fips, chainctl, chartmuseum-fips, consul-k8s, chartmuseum, docker-compose-fips, kubescape-server-fips, linkerd2, falco-no-driver, cluster-api-helm-controller, google-osconfig-agent, kubevela-fips, datadog-agent, envoy-gateway,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: zarf, headlamp, kots, kubevela, kiali, emissary, rancher-fleet, aws-node-termination-handler, rancher-agent, k3s, hubble, docker-cli-buildx, gitlab-runner, envoy-gateway, infinispan-operator, k8sgpt-operator, k8ssandra-client, kubernetes, trivy-operator,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: zarf, headlamp, kots, kubevela, kiali, emissary, rancher-fleet, aws-node-termination-handler, rancher-agent, k3s, hubble, docker-cli-buildx, gitlab-runner, envoy-gateway, infinispan-operator, k8sgpt-operator, k8ssandra-client, kubernetes, trivy-operator,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: zarf, cerbos, pluto, headlamp, kots, rancher-fleet, trivy-operator, envoy-gateway, k8ssandra-client, nova, eksctl, flux-source-controller, helm-push, chartmuseum, cilium-cli, helm-mapkubeapis, harbor, kubescape, zot, helm-docs, trivy, chart-testing, tigera-operator,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: zarf, cerbos, pluto, headlamp, kots, rancher-fleet, trivy-operator, envoy-gateway, k8ssandra-client, nova, eksctl, flux-source-controller, helm-push, chartmuseum, cilium-cli, helm-mapkubeapis, harbor, kubescape, zot, helm-docs, trivy, chart-testing, tigera-operator,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm, harbor-fips, headlamp, helm-set-status, tigera-operator-fips, kots, pluto, cert-manager-cmctl, cerbos, kubescape-server, cloudbeat-fips, harbor, helm-diff, chart-testing, rancher-fleet-fips, kube-arangodb, chartmuseum-fips, linkerd2-fips, helm-docs, helm-push,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, cloudflared, distribution, dkron, cerbos, minio, azure-workload-identity-webhook, falcosidekick, kube-logging-operator, opentelemetry-collector, policy-controller, crossplane-provider-azure-sql, knative-eventing, crossplane-provider-aws-lambda,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: ory-kratos, secrets-store-csi-driver-provider-gcp, cloudprober, fleet-server, longhorn-manager, podman-fips, gotrue-fips, docker-machine-driver-harvester, chartmuseum-fips, crossplane-provider-aws-firehose, grafana-fips, ko, cluster-api-fips,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: ory-kratos, secrets-store-csi-driver-provider-gcp, cloudprober, fleet-server, longhorn-manager, podman-fips, gotrue-fips, docker-machine-driver-harvester, chartmuseum-fips, crossplane-provider-aws-firehose, grafana-fips, ko, cluster-api-fips,...

The vulnerability of the user interface of the Headlamp software for controlling clusters of virtual machines in Kubernetes allows a hacker to execute arbitrary commands.

The vulnerability of the user interface of the Headlamp software for controlling clusters of virtual machines in Kubernetes is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute...

📄 Headlamp 0.38.0 Unauthenticated Cached Credentials Access

Proof of concept exploit for a flaw in Headlamp Kubernetes dashboard versions 0.38.0 and below that allows unauthenticated users to access sensitive Helm release data, including secrets, tokens, and passwords, due to improper server-side caching...

📄 Headlamp 0.38.0 Credential Reuse

A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with config.enableHelm: tru...

Credential caching in Headlamp with Helm enabled

Original tracking issue: https://github.com/kubernetes-sigs/headlamp/issues/4282 CVSS Rating: High 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Description of vulnerability A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse...