CVE-2026-62369
Received Received - Intake

Path Traversal in KubeEdge keadm

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-62369
EUVD
EUVD-2026-84005

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
kubeedge keadm From 1.16.0 (inc) to 1.21.2 (inc)
kubeedge keadm 1.21.2
kubeedge keadm 1.22.2
kubeedge keadm 1.23.1
kubeedge kubeedge From 1.16.0 (inc) to 1.21.2 (exc)
kubeedge kubeedge From 1.22.0 (inc) to 1.22.2 (exc)
kubeedge kubeedge From 1.23.0 (inc) to 1.23.1 (exc)
kubeedge kubeedge 1.21.2
kubeedge kubeedge 1.22.2
kubeedge kubeedge 1.23.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62369 is a path traversal vulnerability in KubeEdge's keadm tool affecting Windows edge nodes. It occurs in the DecompressTarGz function during node join or installation. A malicious tar.gz archive with path traversal sequences like ../, backslashes, absolute paths, or drive-prefixed paths can write files outside the intended extraction directory. This allows overwriting system files with keadm's privileges, potentially enabling persistent system changes or code execution.

Detection Guidance

Detecting this vulnerability requires checking the KubeEdge version and examining keadm operations. Verify installed versions with 'keadm version' or check KubeEdge components. Inspect logs for keadm join/install operations on Windows nodes for unusual file writes or path errors. Monitor system files for unauthorized modifications post-keadm operations.

Impact Analysis

This vulnerability could allow an attacker to modify configuration files, executables, or service files on your Windows edge node. If keadm runs with elevated privileges, the attacker could gain persistent access or execute arbitrary code. The impact depends on which files are overwritten and the privileges of the keadm process.

Compliance Impact

This vulnerability could lead to unauthorized file modifications or code execution on Windows edge nodes, potentially compromising sensitive data handling. For GDPR, it may result in unauthorized access to personal data if configuration or executable files are altered. For HIPAA, it could allow modification of system files storing protected health information if keadm has sufficient privileges.

Mitigation Strategies

Upgrade KubeEdge to patched versions 1.21.2, 1.22.2, or 1.23.1 immediately. Avoid using untrusted download sources for keadm binaries or KubeEdge packages. Verify archive integrity before extraction. Restrict keadm account permissions to limit potential file modifications. Delay Windows edge-node operations if the source is untrusted until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart