CVE-2026-62369: KubeEdge Path Traversal Vulnerability

CVE-2026-62369 Overview

CVE-2026-62369 is a path traversal vulnerability [CWE-22] in KubeEdge, an open source system that extends Kubernetes orchestration to edge nodes. The flaw resides in the DecompressTarGz function within keadm/cmd/keadm/app/cmd/util/common.go. The function joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, a malicious archive can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can write or overwrite files with its own privileges, enabling persistent system modification or code execution.

Critical Impact
A compromised or replaced download source can deliver a crafted archive that overwrites configuration, executable, or service files on Windows edge nodes, leading to persistent code execution under keadm privileges.

Affected Products

KubeEdge versions 1.16.0 through 1.21.1
KubeEdge versions 1.22.0 through 1.22.1
KubeEdge version 1.23.0

Discovery Timeline

2026-09-21 - CVE-2026-62369 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-62369

Vulnerability Analysis

The vulnerability is a classic Zip Slip style path traversal affecting tar archive extraction. keadm downloads and unpacks installation artifacts as part of edge node provisioning. The DecompressTarGz routine iterates over archive entries and constructs an output path by joining the destination directory with the entry name supplied inside the archive.

Because the entry name is attacker-controlled and never resolved against the destination root, entries such as ../../../windows/system32/drivers/etc/hosts, ..\..\Program Files\svc\bin.exe, or absolute paths like C:\Windows\Temp\payload.bat are written outside the extraction directory. On Windows edge nodes, backslashes and drive letters bypass naive prefix checks that assume POSIX separators.

Successful exploitation requires user interaction: an operator must run keadm join or an installation command that fetches the malicious archive. The impact is limited to integrity and availability, since the primitive is arbitrary file write rather than data disclosure.

Root Cause

The root cause is missing containment of extracted paths within the intended destination directory. The pre-patch code relied on filepath.Join, which does not reject traversal sequences or absolute paths. On Windows, the extractor also failed to normalize backslashes and drive-letter prefixes before writing files.

Attack Vector

An attacker compromises, replaces, or otherwise controls the artifact source used by keadm during edge node installation or join operations. This can occur through supply-chain compromise, DNS or network hijacking of the download endpoint, or by convincing an operator to point keadm at an untrusted URL. When the archive is extracted, malicious entries overwrite files anywhere the keadm process can reach.

// Patch: keadm/cmd/keadm/app/cmd/util/common.go
// Adds path and filepath-securejoin imports to safely resolve extraction paths
 	"io"
 	"net/http"
 	"os"
+	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"

+	securejoin "github.com/cyphar/filepath-securejoin"
+
 	"github.com/blang/semver"
 	"github.com/spf13/pflag"
 	versionutil "k8s.io/apimachinery/pkg/util/version"

Source: KubeEdge Commit 47767b7

Detection Methods for CVE-2026-62369

Indicators of Compromise

Unexpected file writes outside the keadm working directory during or shortly after keadm join or installation on Windows edge nodes.
Modified system binaries, service definitions, scheduled tasks, or startup entries created by the keadm.exe process.
Tar archives fetched from non-official mirrors containing entries with ../, ..\, drive-letter prefixes, or absolute paths.

Detection Strategies

Inspect archives before extraction using tar -tzf and flag entries containing .., backslashes, or absolute path prefixes.
Correlate process telemetry to identify file-write events by keadm targeting paths outside its expected install root.
Monitor network destinations contacted by keadm and alert on downloads from hosts other than the official KubeEdge release infrastructure.

Monitoring Recommendations

Enable file integrity monitoring on Windows edge nodes for system directories, service binaries, and startup locations.
Log and retain the full command line, parent process, and download URL for every keadm invocation.
Alert on new or modified executables and scripts in C:\Windows, Program Files, and service configuration paths following an installer run.

How to Mitigate CVE-2026-62369

Immediate Actions Required

Upgrade keadm to KubeEdge 1.21.2, 1.22.2, or 1.23.1 before performing any new edge node join or install operations.
Only download KubeEdge release artifacts from official GitHub releases and verify checksums and signatures.
Audit recently provisioned Windows edge nodes for unauthorized file modifications made by the keadm process.

Patch Information

The issue is fixed in KubeEdge v1.21.2, v1.22.2, and v1.23.1. The fix upgrades github.com/cyphar/filepath-securejoin to v0.3.6 and replaces the unsafe path construction in DecompressTarGz with securejoin, which resolves each extracted path relative to the destination and rejects traversal outside of it. Full details are in KubeEdge Security Advisory GHSA-9vm9-pqxx-x83v and pull requests #7028, #7029, and #7030.

Workarounds

Restrict keadm downloads to signed, checksum-verified archives from the official KubeEdge release page until patched versions are deployed.
Run keadm with the minimum privileges necessary and avoid executing installation commands from administrative sessions where possible.
Perform installations from a staging host, inspect resulting file layouts, and promote validated artifacts to production edge nodes.

bash

# Verify KubeEdge release integrity before extraction
sha512sum -c keadm-v1.23.1-linux-amd64.tar.gz.sha512

# Inspect archive entries for traversal or absolute paths prior to install
tar -tzf keadm-v1.23.1-linux-amd64.tar.gz | \
  grep -E '(^/|^[A-Za-z]:|\.\./|\.\.\\)' && echo 'UNSAFE ARCHIVE'