CVE-2026-62182
Received Received - Intake

Command Injection in KubeEdge

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-62182
EUVD
EUVD-2026-84032

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
kubeedge kubeedge From 1.21.0 (inc) to 1.21.2 (inc)
kubeedge kubeedge 1.22.2
kubeedge kubeedge 1.23.1
kubeedge kubeedge 1.21.0
kubeedge kubeedge 1.21.2
kubeedge kubeedge 1.22.0
kubeedge kubeedge 1.23.0
kubeedge kubeedge From 1.21.0 (inc) to 1.21.3 (exc)
kubeedge kubeedge From 1.22.0 (inc) to 1.22.3 (exc)
kubeedge kubeedge From 1.23.0 (inc) to 1.23.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in KubeEdge allows authenticated users with permission to create or modify ConfigUpdateJob resources to inject shell metacharacters into configuration fields. The system then executes these fields via a system shell, enabling arbitrary command execution on enrolled edge nodes with the privileges of the KubeEdge process handling the job.

Detection Guidance

Detecting this vulnerability requires checking KubeEdge versions and monitoring for suspicious ConfigUpdateJob activity. Check installed versions with 'kubectl get pods -n kubeedge -l k8s-app=kubeedge' and compare against patched versions (1.21.2, 1.22.2, 1.23.1). Inspect ConfigUpdateJob resources for unexpected commands or shell metacharacters in updateFields using 'kubectl get configupdatejobs -A -o yaml'.

Impact Analysis

An attacker could execute arbitrary commands on edge nodes, potentially leading to data breaches, unauthorized access, or disruption of services. The impact depends on the privileges of the KubeEdge process, which typically runs with elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Immediately upgrade KubeEdge to patched versions (1.21.2, 1.22.2, or 1.23.1) using official releases. Restrict RBAC permissions to prevent unauthorized ConfigUpdateJob modifications. Avoid using ConfigUpdateJob in untrusted environments and monitor edge nodes for unexpected command execution or file changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart