CVE-2026-29954: KubePlus · Server-Side Request Forgery (SSRF)
Affects KubePlusSource CVE Database V5
Not known to be exploited · CVSS 7.6 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubb0b0haha/KubePluspkg:github/b0b0haha/KubePlusOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2026-29954, organizations should immediately review and restrict access to the ResourceComposition resources to trusted users only, minimizing the risk of malicious input. Implement strict input validation and sanitization for the chartURL field to ensure only legitimate and safe URLs are accepted, rejecting any URLs containing suspicious characters or command injection patterns. Avoid using direct command concatenation with user input; instead, refactor kubeconfiggenerator to use safer methods such as parameterized commands or libraries that handle URL fetching without shell invocation. If possible, replace wget usage with secure HTTP client libraries that do not invoke shell commands. Monitor logs for unusual wget command executions or unexpected HTTP headers in outgoing requests. Apply network segmentation and firewall rules to limit the vulnerable server's ability to reach internal or sensitive endpoints, reducing SSRF impact. Stay alert for official patches or updates from KubePlus maintainers and apply them promptly once available. Additionally, conduct security reviews and penetration testing focused on webhook and resource handling components to detect similar injection issues.
Description
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection.