Kubernetes Alert: Headlamp Flaw (CVE-2025-14269) Lets Unauthenticated Users Hijack Helm Clusters

A high-severity vulnerability in Headlamp, CVE-2025-14269, could let unauthenticated attackers hijack Helm operations in Kubernetes via the Headlamp UI. The flaw stems from how credentials are handled when interfacing with Helm, and it carries a CVSS of 8.8, signalling a critical risk for organisations using Headlamp to manage their clusters.

Headlamp’s in-cluster version is affected, and the issue arises when a legitimate administrator’s credentials are cached insecurely, allowing a subsequent unauthenticated user with dashboard access to piggyback on those cached credentials to perform Helm actions without logging in, according to the disclosure. A perfect storm of conditions is required: Headlamp must be installed in-cluster, config[.]enableHelm must be true, and an authorised user must have previously accessed Helm functionality.

The vulnerability affects Headlamp versions v0.38.0 and earlier; a patch is available in v0.39.0, with administrators urged to upgrade immediately, and as a mitigation, not exposing Headlamp publicly with an ingress server. Detection guidance suggests reviewing logs for unexpected access to Helm-related endpoints such as clusters/main/helm/releases/list.