CVE Feed

    Dashboard / CVE / CVE-2026-29954

    CVE-2026-29954

    In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection.

    Published:Mar 30, 2026
    Last Modified:Apr 7, 2026
    EPS:Mar 30, 2026
    EPSS Score:0.00036
    CVSS Score:7.6

    Affected Products

    Vendor
    Cloud-ark
    Product
    Kubeplus
    Vendor
    Cloudark
    Product
    Kubeplus

    Exploits

    https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.mdhttps://github.com/b0b0haha/CVE-2026-29954

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High