An SSRF vulnerability exists in the mutating webhook and kubeconfiggenerator components of KubePlus version 4.1.4 when processing the chartURL field in ResourceComposition resources. The field is only URL‑encoded, with no validation of the target address. In addition, the kubeconfiggenerator builds a wget command by directly concatenating the chartURL value, allowing attackers to inject wget’s --header option and perform arbitrary HTTP header injection, which may subvert authentication or other security controls. The weakness corresponds to CWE‑88 (Unvalidated Redirects and Forwards) and CWE‑918 (Server Side Request Forgery).

The vulnerability affects the KubePlus 4.1.4 distribution provided by CloudArk. No other vendors or product versions are listed as impacted, so the scope is limited to installations running this specific release.

The CVSS score of 7.6 indicates high severity, while an EPSS score of less than 1% suggests a low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires only a crafted ResourceComposition object containing an unvalidated chartURL value, which a remote attacker could supply via the API server. The likely attack vector is remote through the Kubernetes API, enabling the attacker to force the server to perform requests to arbitrary URLs and inject custom HTTP headers, potentially exposing internal resources or facilitating credential theft.