CVE-2026-62371: KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
The KubeEdge NodeUpgradeJob handler constructed the keadm upgrade edge command by concatenating the user-controlled spec.version and spec.image fields into a shell command.
An authenticated user with permission to create or update NodeUpgradeJob resources through the v1alpha2 API could include shell metacharacters in either field. When the upgrade job was processed, the injected command could be executed on the targeted edge node with the privileges available to the upgrade process.
Successful exploitation could result in arbitrary command execution and compromise the confidentiality, integrity, and availability of the affected edge node.
References
- github.com/advisories/GHSA-5jpj-293f-rhvj
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md
- github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md
- github.com/kubeedge/kubeedge/commit/552af457a4c7ce80ea1678ab5889f475b36ea103
- github.com/kubeedge/kubeedge/commit/657b745bebcdd7a221eb34c0aac13231ef12c37f
- github.com/kubeedge/kubeedge/commit/b72db7f8a0f7be23261b4349eab33024b2007df0
- github.com/kubeedge/kubeedge/pull/7028
- github.com/kubeedge/kubeedge/pull/7029
- github.com/kubeedge/kubeedge/pull/7030
- github.com/kubeedge/kubeedge/releases/tag/v1.21.2
- github.com/kubeedge/kubeedge/releases/tag/v1.22.2
- github.com/kubeedge/kubeedge/releases/tag/v1.23.1
- github.com/kubeedge/kubeedge/security/advisories/GHSA-5jpj-293f-rhvj
- nvd.nist.gov/vuln/detail/CVE-2026-62371
Code Behaviors & Features
Detect and mitigate CVE-2026-62371 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →