CVE-2026-29954

In KubePlus 4.1.4 , the mutating webhook and kubeconfiggenerator components are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of the chartURL field in ResourceComposition resources. Furthermore, because the kubeconfiggenerator directly concatenates this field int...