CVE-2026-29954

CVE-2026-29954 describes a high-severity Server-Side Request Forgery (SSRF) vulnerability in KubePlus 4.1.4, affecting its mutating webhook and kubeconfiggenerator components. This flaw allows an attacker to inject arbitrary HTTP headers into `wget` commands by manipulating the `chartURL` field of `ResourceComposition` resources, due to improper validation and direct command concatenation. Rated with a CVSS score of 7.6 (High), successful exploitation requires high privileges but has low attack complexity, potentially leading to significant confidentiality impact and minor integrity compromise. There is currently no evidence of active exploitation, nor are public exploit modules or widespread media coverage available, though it has received minor community discussion.