CVE-2026-29955
Published: 13 April 2026
Description
The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses `subprocess.Popen()` with `shell=True` parameter to execute shell commands, and the user-supplied `chartName` parameter is directly concatenated into the command string without any…
more
sanitization or validation. An attacker can inject arbitrary shell commands by crafting a malicious `chartName` parameter value.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the user-supplied chartName parameter to block malicious shell command injection in the /registercrd endpoint.
Enforces restrictions on inputs at the endpoint boundary to prevent unsanitized chartName values from enabling command injection.
Mandates timely remediation of the specific command injection flaw in the kubeconfiggenerator component's subprocess.Popen usage.
Security SummaryAI
CVE-2026-29955 is a command injection vulnerability affecting the `/registercrd` endpoint in the kubeconfiggenerator component of KubePlus version 4.14. The flaw arises because the component invokes `subprocess.Popen()` with the `shell=True` parameter to execute shell commands, directly concatenating the user-supplied `chartName` parameter into the command string without sanitization or validation. This was published on 2026-04-13 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-94 (Improper Control of Generation of Code).
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. By crafting a malicious `chartName` value, the attacker injects arbitrary shell commands, potentially achieving high confidentiality, integrity, and availability impacts, such as executing unauthorized code on the host system running the kubeconfiggenerator.
Advisories and further details are documented in the provided references, including a GitHub Gist at https://gist.github.com/b0b0haha/f011fdd69adc3ae272a4e3b99af90163 and a GitHub repository README at https://github.com/b0b0haha/CVE-2026-29955/blob/main/README.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via unsanitized user input to subprocess.Popen(shell=True) on a network-accessible /registercrd endpoint directly enables remote exploitation of a public-facing application (T1190) to achieve arbitrary Unix shell command execution (T1059.004).