CVE-2026-62371
HighCVSS 8.8Summary
In KubeEdge from 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes.
Risk Assessment
A user with NodeUpgradeJob management permissions can execute arbitrary commands on edge nodes with the privileges of the upgrade process, compromising node confidentiality, integrity, and availability.
Recommendation
Update KubeEdge to version 1.21.2, 1.22.2, or 1.23.1 (or later). Until patched, restrict permissions to create and update NodeUpgradeJob resources.
Other vulnerabilities in KubeEdge
See all- CVE-2026-62369High
KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go. The function joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory.
- CVE-2026-62182High
KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go. Authenticated user-controlled updateFields values are concatenated into the keadm config-update command and executed through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job.
- CVE-2026-62370Medium
KubeEdge from version 1.0.0 to 1.21.2, 1.22.2, and 1.23.1 is vulnerable to memory exhaustion. The message reader in pkg/viaduct/pkg/packer trusts the 32-bit PayloadLen field from CloudHub and allocates memory before validating an upper bound. An authenticated malicious or compromised edge peer can send crafted headers causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication.
Original NVD description (English source)
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.