CVE-2026-29954

KubePlus version 4.1.4 is vulnerable to Server-Side Request Forgery (SSRF) and command injection within the mutating webhook and kubeconfiggenerator components. The issue arises when processing the chartURL field of ResourceComposition resources, which is URL-encoded without address validation. S...