CVE-2026-62371

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.12.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0

Description The v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. An authenticated user with permissions to create or update NodeUpgradeJob resources can inject shell metacharacters into these fields to execute arbitrary commands on targeted edge nodes. This execution occurs with the privileges of the upgrade process, potentially compromising the confidentiality, integrity, and availability of the node.

Recommendations Update to version 1.21.2. Update to version 1.22.2. Update to version 1.23.1.