Kubeplus vulnerabilities

2 known vulnerabilities in Kubeplus from Cloudark. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Kubeplus: Improper Control of Generation of Code

  CVE-2026-29955Apr 13, 2026CloudarkEPSS 2.22%

  The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses `subprocess.Popen()` with `shell=True` parameter to execute shell commands, and the user-supplied `chartName` parameter is

• 7.6 High severity

  Kubeplus: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-29954Mar 30, 2026Cloudark

  In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, whe