CVE-2026-62182: KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes.
The updateFields values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update ConfigUpdateJob resources could include shell metacharacters in the supplied configuration fields and cause unintended commands to be executed on targeted edge nodes.
References
- github.com/advisories/GHSA-m3c6-2p7h-cfr3
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md
- github.com/kubeedge/kubeedge/commit/14f65fc6207787f266cbcb0dceac7f09a81bab2b
- github.com/kubeedge/kubeedge/commit/6309a335c8e5e3c154b6bb0a09292f5c7dc598dc
- github.com/kubeedge/kubeedge/commit/ee78415a36911c1a93e59a921c23b8e4ecd83e90
- github.com/kubeedge/kubeedge/pull/7028
- github.com/kubeedge/kubeedge/pull/7029
- github.com/kubeedge/kubeedge/pull/7030
- github.com/kubeedge/kubeedge/releases/tag/v1.21.2
- github.com/kubeedge/kubeedge/releases/tag/v1.22.2
- github.com/kubeedge/kubeedge/releases/tag/v1.23.1
- github.com/kubeedge/kubeedge/security/advisories/GHSA-m3c6-2p7h-cfr3
- nvd.nist.gov/vuln/detail/CVE-2026-62182
Code Behaviors & Features
Detect and mitigate CVE-2026-62182 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →