CVE-2026-29955

CVE-2026-29955 is a command injection vulnerability in the kubeconfiggenerator component of KubePlus versions 4.14, specifically in the /registercrd endpoint. The flaw exists because the component uses subprocess.Popen() with shell=True while directly concatenating unsanitized user input from the chartName parameter into shell commands, allowing attackers to inject and execute arbitrary commands. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low privileges and no user interaction. Successful exploitation would result in high-impact compromises across confidentiality, integrity, and availability of the affected system. The EPSS score of 0.00088 indicates relatively low predicted exploitation probability compared to the broader CVE landscape. There is currently no evidence of active exploitation, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat tracking lists. However, organizations running KubePlus 4.14 should prioritize patching given the ease of exploitation and severe potential impact, particularly in environments where the kubeconfiggenerator component is exposed to authenticated users.