CVE-2026-29954

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29954
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection.

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0 Exploit Mitigation Third Party Advisory
https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md Exploit Mitigation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudark:kubeplus:4.1.4:*:*:*:*:*:*:*
History

06 Apr 2026, 15:51

Type Values Removed Values Added
CPE cpe:2.3:a:cloudark:kubeplus:4.1.4:*:*:*:*:*:*:*
References () https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0 - () https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0 - Exploit, Mitigation, Third Party Advisory
References () https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md - () https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md - Exploit, Mitigation, Third Party Advisory
First Time Cloudark kubeplus
Cloudark

01 Apr 2026, 14:24

Type Values Removed Values Added
Summary
  • (es) En KubePlus 4.1.4, los componentes mutating webhook y kubeconfiggenerator tienen una vulnerabilidad SSRF al procesar el campo chartURL de los recursos ResourceComposition. El campo solo está codificado en URL sin validar la dirección de destino. Más críticamente, cuando kubeconfiggenerator utiliza wget para descargar charts, la chartURL se concatena directamente en el comando, permitiendo a los atacantes inyectar la opción --header de wget para lograr la inyección arbitraria de encabezados HTTP.

30 Mar 2026, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.6
CWE CWE-918
CWE-88

30 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-30 17:16

Updated : 2026-04-06 15:51

NVD link : CVE-2026-29954

Mitre link : CVE-2026-29954

CVE.ORG link : CVE-2026-29954

JSON object : View

Products Affected

cloudark

  • kubeplus
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-918

Server-Side Request Forgery (SSRF)