CVE-2026-62370
MediumCVSS 6.5Summary
KubeEdge from version 1.0.0 to 1.21.2, 1.22.2, and 1.23.1 is vulnerable to memory exhaustion. The message reader in pkg/viaduct/pkg/packer trusts the 32-bit PayloadLen field from CloudHub and allocates memory before validating an upper bound. An authenticated malicious or compromised edge peer can send crafted headers causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication.
Risk Assessment
The attack can cause CloudHub disruption and temporary cloud-edge communication outages, reducing service availability.
Recommendation
Update KubeEdge to versions 1.21.2, 1.22.2, or 1.23.1, which include a fix to cap memory allocation.
Other vulnerabilities in KubeEdge
See all- CVE-2026-62369High
KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go. The function joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory.
- CVE-2026-62182High
KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go. Authenticated user-controlled updateFields values are concatenated into the keadm config-update command and executed through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job.
- CVE-2026-62371High
In KubeEdge from 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes.
Original NVD description (English source)
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.