CVE-2026-62182: KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubeEdgeto a version that resolves this vulnerability.Fixed in 1.21.2 - Upgrade
Upgrade
KubeEdgeto a version that resolves this vulnerability.Fixed in 1.22.2 - Upgrade
Upgrade
KubeEdgeto a version that resolves this vulnerability.Fixed in 1.23.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to create or modify ConfigUpdateJob resources can exploit it. The attacker can target an enrolled edge node through a ConfigUpdateJob.
What access does successful exploitation provide?
An attacker can inject shell metacharacters into the complete --set value in updateFields, causing arbitrary commands to run on the target edge node. Commands execute with the privileges of the KubeEdge process handling the job.
Which releases should be updated?
The issue affects KubeEdge versions beginning with 1.21.0 and is fixed in 1.21.2, 1.22.2, and 1.23.1. Update to the applicable fixed release for the deployed release line.
What can be done if an update cannot be applied immediately?
Restrict permission to create or modify ConfigUpdateJob resources to only fully trusted users and service identities. This removes the stated attacker capability needed to supply malicious updateFields values.