diff --git a/include/security_headers_middleware.hpp b/include/security_headers_middleware.hpp
index 5e8e7d9..1ebc43c 100644
--- a/include/security_headers_middleware.hpp
+++ b/include/security_headers_middleware.hpp
@@ -36,7 +36,12 @@
 
         res.addHeader(bf::pragma, "no-cache");
         res.addHeader(bf::cache_control, "no-Store,no-Cache");
-        res.addHeader("Content-Security-Policy", "default-src 'self'");
+
+        // The KVM currently needs to load images from base64 encoded strings.
+        // img-src 'self' data: is used to allow that.
+        // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28
+        res.addHeader("Content-Security-Policy",
+                      "default-src 'self'; img-src 'self' data:");
         res.addHeader("X-XSS-Protection", "1; "
                                           "mode=block");
         res.addHeader("X-Content-Type-Options", "nosniff");