PT-2026-29059 · Kubeplus · Kubeplus

B0B0Haha · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-29954

Positive Technologies · (AI Summary)

CVSS v3.1

7.6

High

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions KubePlus version 4.1.4

Description KubePlus versions 4.1.4 contain a Server-Side Request Forgery (SSRF) issue within the mutating webhook and kubeconfiggenerator components when handling the chartURL field of ResourceComposition resources. The chartURL field is URL-encoded without proper validation of the target address. Specifically, when the kubeconfiggenerator component uses wget to download charts, the chartURL is directly incorporated into the command, enabling attackers to inject wget's --header option and achieve arbitrary HTTP header injection. The API endpoint used for chart downloads is not specified. The vulnerable parameter is chartURL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Argument Injection

Weakness Enumeration

CWE-918

CWE-88

Related Identifiers

CVE-2026-29954

Affected Products

Kubeplus

References · 4

• 🔥 https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29954 · Security Note
• https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0 · Note
• https://twitter.com/cyberbivash/status/2038696017181266074 · Twitter Post