Do Son 
Simplified application deployment in Kubernetes using Helm can lead to serious vulnerabilities if default configurations are left unexamined. According to a recent report from the Microsoft Defender for Cloud Research team, deploying unmodified Helm charts can result in direct exposure of sensitive data and leave clusters open to internet-based attacks.
Helm charts facilitate rapid service deployment in Kubernetes by providing a collection of YAML manifests that define the necessary resources and parameters for launching applications. However, as the researchers caution, in their pursuit of speed and convenience, many developers and administrators—particularly those lacking robust cloud security expertise—often deploy these charts “as is,” without scrutinizing their configuration. This oversight can leave services unauthenticated, expose open ports, and employ weak or hardcoded passwords that are easily compromised.
The report highlights three illustrative examples of insecure configurations found in widely used Helm charts. In the case of Apache Pinot, critical components such as pinot-controller and pinot-broker are exposed via a LoadBalancer without any form of access control. The Helm chart for Meshery permits user registration through a public IP address, effectively granting unauthorized access to cluster management. Meanwhile, one variant of Selenium Grid exposes its service using NodePort on all nodes, with the sole line of defense being external network filtering. While the official version of the chart has safeguards in place, numerous third-party projects on GitHub have inherited this flawed configuration.
Notably, with Selenium Grid, there have been prior incidents where misconfigured deployments allowed attackers to run XMRig miners, exploiting compromised cluster resources to mine Monero. The issue became so widespread that it garnered the attention of several infrastructure security firms.
To mitigate such risks, Microsoft strongly advises performing thorough analysis of chart content prior to deployment, with particular focus on authentication mechanisms and network isolation. Additionally, organizations should regularly scan their systems for misconfigurations that expose services to the internet and maintain continuous monitoring of container behavior to promptly detect and respond to anomalies.
