Cloudark KubePlus 4.1.4

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:cloudark:kubeplus:4.1.4:*:*:*:*:*:*:*

part: a version: 4.1.4 update: *

VendorCloudark (6c3a3e5e-5d21-555a-ae49-6828b122de6c)
ProductKubeplus (a26dded9-eb0d-534c-a0f7-0b53dfb4efb8)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/cloud-ark/kubeplus purl2cpe 2026-07-28 16:40:48.945127

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-29954 vulnerable 2026-06-08 07:55:16.345170 Details available
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection.
Published: 2026-03-30T00:00:00.000Z
Updated: 2026-03-30T18:42:18.548Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.