Skip to content
OpenAdvisories

Vendor

kubeedge

13 known vulnerabilities.

Products

kubeedge 13
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-62182

    KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatena…

    kubeedge kubeedge github.com/kubeedge/kubeedge Go
  • High 8.1
    CVE-2026-62369

    KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive en…

    kubeedge kubeedge github.com/kubeedge/kubeedge Go
  • High 8.8
    CVE-2026-62371

    KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

    KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go c…

    kubeedge kubeedge github.com/kubeedge/kubeedge Go
  • High 8.2
    CVE-2026-82473

    KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

    KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade…

    kubeedge kubeedge