CVE-2026-29955 - Vulnerability Analysis

Overview

KubePlus 4.14 kubeconfiggenerator component contains a command injection caused by unsanitized user input in the chartName parameter used with subprocess.Popen(shell=True), letting attackers execute arbitrary shell commands remotely, exploit requires crafted chartName parameter.

Severity & Score

Impact

Attackers can execute arbitrary shell commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version with proper input sanitization or validation for the chartName parameter.

References

• https://gist.github.com/b0b0haha/f011fdd69adc3ae272a4e3b99af90163
• https://github.com/b0b0haha/CVE-2026-29955/blob/main/README.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner