CVE-2026-62182
HighCVSS 8.8Summary
KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go. Authenticated user-controlled updateFields values are concatenated into the keadm config-update command and executed through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job.
Risk Assessment
An authenticated user can execute arbitrary commands on the edge node, potentially leading to full node compromise and further escalation within the cluster. This could result in breach of system integrity and confidentiality.
Recommendation
Update KubeEdge to versions 1.21.2, 1.22.2, or 1.23.1. Restrict permissions to create or modify ConfigUpdateJob resources to trusted users.
Other vulnerabilities in KubeEdge
See all- CVE-2026-62369High
KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go. The function joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory.
- CVE-2026-62371High
In KubeEdge from 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes.
- CVE-2026-62370Medium
KubeEdge from version 1.0.0 to 1.21.2, 1.22.2, and 1.23.1 is vulnerable to memory exhaustion. The message reader in pkg/viaduct/pkg/packer trusts the 32-bit PayloadLen field from CloudHub and allocates memory before validating an upper bound. An authenticated malicious or compromised edge peer can send crafted headers causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication.
Original NVD description (English source)
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.