CVE-2026-62371 Overview
CVE-2026-62371 is a command injection vulnerability [CWE-78] in KubeEdge, an open source system that extends Kubernetes container orchestration to edge nodes. The v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values directly into the keadm upgrade edge shell command. An authenticated user with permission to create or update NodeUpgradeJob resources can inject shell metacharacters into either field. This causes arbitrary commands to run on targeted edge nodes with the privileges of the upgrade process. KubeEdge versions from 1.12.0 through 1.21.1, 1.22.1, and 1.23.0 are affected.
Critical Impact
An authenticated attacker with NodeUpgradeJob privileges can execute arbitrary shell commands on edge nodes, fully compromising confidentiality, integrity, and availability of the edge fleet.
Affected Products
- KubeEdge 1.12.0 through 1.21.1
- KubeEdge 1.22.0 through 1.22.1
- KubeEdge 1.23.0
Discovery Timeline
- 2026-09-21 - CVE-2026-62371 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-62371
Vulnerability Analysis
KubeEdge distributes node upgrade tasks from the cloud control plane to edge nodes through NodeUpgradeJob resources. When an edge node receives a job, the task manager builds a keadm upgrade edge command line using values supplied in the job specification. The handler passes the resulting string to a shell for execution instead of invoking the binary through an argument vector.
Because spec.version and spec.image flow into the command without sanitization or validation, shell metacharacters such as ;, |, backticks, and $(...) break out of the intended command. Any process spawned inherits the privileges of the KubeEdge upgrade process on the edge node, which typically runs with elevated rights to manage system binaries and services.
The issue is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation requires authenticated Kubernetes API access with rights to write NodeUpgradeJob objects, but no user interaction is needed on the edge node.
Root Cause
The root cause is the use of shell-based command construction with unsanitized user input in edge/pkg/taskmanager/actions/nodeupgradejob.go. The admission controller in cloud/pkg/admissioncontroller/admit_nodeupgradejob.go accepted spec.version and spec.image values without rejecting shell metacharacters. Neither layer enforced strict format validation before the values reached the shell.
Attack Vector
An attacker authenticates to the Kubernetes API server managing the KubeEdge cloud core. Using rights to create or update NodeUpgradeJob resources in the operations.kubeedge.io/v1alpha2 API group, the attacker submits a job whose spec.version or spec.image field embeds shell payloads. When the task reaches targeted edge nodes, the injected commands run with the upgrade process privileges, enabling data theft, persistence, or lateral movement across the edge fleet.
// Patch excerpt: edge/pkg/taskmanager/actions/nodeupgradejob.go
// Source: https://github.com/kubeedge/kubeedge/commit/552af457a4c7ce80ea1678ab5889f475b36ea103
"context"
"encoding/json"
"fmt"
+ "os"
+ "os/exec"
"path/filepath"
"runtime"
- "strings"
"time"
"github.com/go-logr/logr"
The fix removes shell string construction (strings import dropped) and switches to direct process invocation using os/exec with argument vectors. The companion admission controller change adds pkg/util/validation checks on incoming NodeUpgradeJob fields.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-62371
Indicators of Compromise
- NodeUpgradeJob objects containing shell metacharacters (;, |, &, backticks, $() in spec.version or spec.image fields.
- Unexpected child processes of the KubeEdge edgecore or upgrade process on edge nodes, including shells, network tools, or package managers.
- New or modified NodeUpgradeJob resources created by service accounts that do not normally manage upgrades.
- Outbound network connections from edge nodes to unrecognized hosts shortly after an upgrade job is dispatched.
Detection Strategies
- Audit the Kubernetes API server for create and update verbs against nodeupgradejobs.operations.kubeedge.io and alert on payloads containing shell metacharacters.
- Monitor process ancestry on edge nodes for keadm upgrade edge spawning interpreters (sh, bash, python) or command chains.
- Correlate NodeUpgradeJob submission events with edge node process creation and file modification telemetry.
Monitoring Recommendations
- Ingest KubeEdge cloud core and edge core logs into a centralized analytics platform for retrospective hunting.
- Enable Kubernetes audit logging at Metadata or higher for the operations.kubeedge.io API group.
- Track RBAC bindings that grant write access to NodeUpgradeJob resources and review any expansion of that permission set.
How to Mitigate CVE-2026-62371
Immediate Actions Required
- Upgrade KubeEdge to version 1.21.2, 1.22.2, or 1.23.1 depending on your deployment branch.
- Review RBAC policies and restrict create and update permissions on nodeupgradejobs.operations.kubeedge.io to trusted service accounts only.
- Inspect existing NodeUpgradeJob objects for suspicious spec.version or spec.image values before applying the patch.
Patch Information
The KubeEdge maintainers fixed the vulnerability in KubeEdge v1.21.2, KubeEdge v1.22.2, and KubeEdge v1.23.1. The fix commits (552af45, 657b745, b72db7f) replace shell command construction with os/exec argument vectors and add input validation in the admission controller. Full details are in the KubeEdge Security Advisory GHSA-5jpj-293f-rhvj.
Workarounds
- Remove or tightly scope create/update RBAC permissions on NodeUpgradeJob resources until patching completes.
- Deploy an admission webhook that rejects NodeUpgradeJob objects whose spec.version or spec.image values contain characters outside a strict allowlist (for example, [A-Za-z0-9._:/@-]).
- Isolate the KubeEdge cloud core API endpoints on a management network with additional authentication controls.
# Example: restrict NodeUpgradeJob write access via RBAC
kubectl get clusterrolebindings -o json | \
jq '.items[] | select(.roleRef.name | test("nodeupgrade|kubeedge-admin"))'
# Upgrade KubeEdge cloud and edge components
keadm reset --force
keadm init --kubeedge-version=1.23.1
keadm join --kubeedge-version=1.23.1 --cloudcore-ipport=<cloud-ip>:10000
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
