CVE-2026-62369: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubeEdge (keadm)to a version that resolves this vulnerability.Fixed in 1.21.2 - Upgrade
Upgrade
KubeEdge (keadm)to a version that resolves this vulnerability.Fixed in 1.22.2 - Upgrade
Upgrade
KubeEdge (keadm)to a version that resolves this vulnerability.Fixed in 1.23.1
Event History
Frequently Asked Questions
Which systems are exposed?
Windows edge nodes running affected KubeEdge keadm versions are exposed when keadm join or installation extracts an archive from a compromised, replaced, or otherwise untrusted download source. The issue affects versions from 1.16.0 up to, but not including, 1.21.2, 1.22.2, and 1.23.1.
What does an attacker need to exploit this?
An attacker needs to influence the archive consumed during keadm join or installation, such as by compromising or replacing its download source. They do not need pre-existing privileges on the edge node, but exploitation requires a user to run the affected join or installation workflow.
What is the potential impact on the affected Windows node?
A crafted archive can cause keadm to write or overwrite files outside the intended extraction directory using the privileges of the keadm process. This can modify configuration, executable, or service files and may enable persistent system modification or code execution.
What should teams do if they cannot patch immediately?
Do not run keadm join or installation against archives from untrusted, replaceable, or potentially compromised download sources. Restrict the workflow to trusted archive sources until upgrading to 1.21.2, 1.22.2, 1.23.1, or later.