Executive brief
KubePlus, a tool used to manage Kubernetes multi-tenancy and custom resources, contains a security flaw in its configuration generator component. An attacker with access to the application's web interface can execute unauthorized commands on the underlying server. This could allow an attacker to take full control of the container, steal sensitive security tokens, and potentially gain administrative access to the entire Kubernetes cluster.
Technical details
An OS command injection vulnerability exists in the `kubeconfiggenerator` component of KubePlus (specifically version 4.1.4 and 4.2.0). The `/registercrd` endpoint processes user-supplied input via the `chartName` parameter and passes it to the `download_and_untar_chart()` function. This function uses `subprocess.Popen()` with `shell=True` to execute shell commands like `wget` and `rm`, concatenating the `chartName` directly into the command string without sanitization. A remote attacker with network access to the HTTP interface can use shell substitution syntax (e.g., `$(command)`) to execute arbitrary code as root within the container. This can be further leveraged to steal ServiceAccount tokens with cluster-admin privileges.
Affected products
- CloudArk KubePlus 4.1.4, 4.2.0
Timeline
- 2026-04-13: advisory: Initial disclosure and CVE assignment
- 2026-05-01: other: NVD initial analysis completed