CVE-2026-62371
Received Received - Intake

Command Injection in KubeEdge

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-62371
EUVD
EUVD-2026-84003

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
kubeedge kubeedge From 1.12.0 (inc) to 1.21.2 (exc)
kubeedge kubeedge From 1.22.0 (inc) to 1.22.2 (exc)
kubeedge kubeedge From 1.23.0 (inc) to 1.23.1 (exc)
kubeedge kubeedge From 1.12.0 (inc) to 1.21.2 (inc)
kubeedge kubeedge 1.21.2
kubeedge kubeedge 1.22.2
kubeedge kubeedge 1.23.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62371 is a command injection vulnerability in KubeEdge's NodeUpgradeJob component. It allows authenticated users with permission to create or update NodeUpgradeJob resources to inject shell metacharacters into the spec.version or spec.image fields. These fields are then concatenated into a shell command without proper sanitization, enabling arbitrary command execution on edge nodes with the privileges of the upgrade process.

Detection Guidance

To detect this vulnerability, check if your KubeEdge version is between 1.12.0 and 1.21.1, 1.22.0 and 1.22.1, or 1.23.0 and 1.23.0. Use commands like 'kubectl get pods -n kubeedge -l k8s-app=kubeedge' to verify the running version. Inspect NodeUpgradeJob resources for suspicious spec.version or spec.image values containing shell metacharacters.

Impact Analysis

This vulnerability can compromise the confidentiality, integrity, and availability of affected edge nodes. An attacker could execute arbitrary commands on these nodes, potentially stealing data, modifying system configurations, or disrupting services. The impact depends on the privileges of the upgrade process and the sensitivity of the edge node's data.

Compliance Impact

This vulnerability could lead to unauthorized code execution on edge nodes, potentially compromising sensitive data confidentiality and integrity. For GDPR, this may result in unauthorized access to personal data, violating principles of data protection and user rights. For HIPAA, it could expose protected health information to unauthorized parties, violating security and privacy requirements.

Mitigation Strategies

Immediately upgrade KubeEdge to versions 1.21.2, 1.22.2, or 1.23.1 or later. Restrict NodeUpgradeJob permissions to trusted administrators only. Avoid allowing untrusted users to control spec.version or spec.image fields in NodeUpgradeJob resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart