CVE-2026-62371: KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.23.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user who has permission to create or update v1alpha2 NodeUpgradeJob resources can exploit it. The attacker does not need user interaction and can target edge nodes through a crafted upgrade job.
Are default deployments affected?
The issue is reachable through the v1alpha2 NodeUpgradeJob handler, but the provided information does not state whether NodeUpgradeJob creation or update permissions are granted by default. Exposure depends on whether users or service accounts have those permissions and whether they can submit jobs targeting edge nodes.
What access does successful exploitation provide?
Injected commands execute on targeted edge nodes with the privileges of the upgrade process. This can compromise the confidentiality, integrity, and availability of those nodes.
Which versions should be upgraded?
Upgrade to KubeEdge 1.21.2, 1.22.2, or 1.23.1. Versions from 1.12.0 up to the relevant fixed release are affected.
What can be done before patching?
Restrict create and update permissions for v1alpha2 NodeUpgradeJob resources to only fully trusted administrators. Treat spec.version and spec.image values in existing or proposed NodeUpgradeJobs as untrusted, particularly if they contain shell metacharacters.