CVE-2026-82473: KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubeEdge CloudCoreto a version that resolves this vulnerability.Fixed in 1.23.1 - Configuration
Configure CloudCore to require authentication when accepting node task status reports on its HTTPS server (node task endpoints) to prevent unauthorized marking of upgrade jobs as succeeded/failed.
KubeEdge CloudCore HTTPS server (node task endpoints) authentication verification = required - Compensating control
Restrict network access to KubeEdge CloudCore on port 10002 so only the control plane/nodes can reach it, preventing attackers from altering upgrade job statuses.
Event History
Frequently Asked Questions
Who is exposed to this issue?
CloudCore deployments through version 1.23.1 are exposed if an attacker can reach the CloudCore HTTPS server on port 10002. No authentication is required for the affected node task status reports.
What can an attacker do with access to the affected endpoint?
An attacker can submit node task status reports that mark upgrade jobs as succeeded or failed. This can mislead the control plane about node upgrade state and prevent further upgrade scheduling.
What access does exploitation require?
Exploitation requires network reachability to CloudCore port 10002. The reported attack vector is network-based, with no privileges or user interaction required.