ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-62371

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-62371

Published

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-62371

Published

kubeedge

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "kubeedge",
                    "product": "kubeedge",
                    "versions": [
                        {
                            "version": ">= 1.12.0, < 1.21.2",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.22.0, < 1.22.2",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.23.0, < 1.23.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON