Command Injection in KubeEdge Affects Versions 1.21.0 to 1.23.1
CVE-2026-62182
8.8HIGH
What is CVE-2026-62182?
A vulnerability exists in KubeEdge, where the ConfigUpdateJob processing allows a user to manipulate authenticated user-controlled updateFields values. By injecting shell metacharacters into the command through this mechanism, an attacker can execute arbitrary commands on the enrolled target edge node. This poses a significant risk as it operates under the privileges of the KubeEdge process, which could lead to unauthorized data access or disruption of services. The issue has been remediated in versions 1.21.2, 1.22.2, and 1.23.1.
Affected Version(s)
kubeedge >= 1.21.0, < 1.21.2 < 1.21.0, 1.21.2
kubeedge >= 1.22.0, < 1.22.2 < 1.22.0, 1.22.2
kubeedge >= 1.23.0, < 1.23.1 < 1.23.0, 1.23.1