Kubeedge
Monthly
Authenticated command injection in KubeEdge (1.21.0 up to 1.21.2, 1.22.2, and 1.23.1) lets a principal holding Kubernetes RBAC rights to create or modify ConfigUpdateJob resources inject shell metacharacters into the updateFields passed to the keadm config-update command, which the edge taskmanager then runs through a system shell, yielding arbitrary command execution on the enrolled target edge node with the privileges of the KubeEdge process. The vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment is slightly more severe because compromise of the node process is a scope change (S:C); the PR:L vector confirms the attacker must be authenticated and authorized, so this is not anonymous or remotely unauthenticated abuse. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the flaw is a genuine, actionable CWE-78 issue rather than an inflated score, and it is fixed in KubeEdge 1.21.2, 1.22.2, and 1.23.1.
Shell command injection in KubeEdge's v1alpha2 NodeUpgradeJob upgrade workflow allows an authenticated user who holds RBAC permission to create or update NodeUpgradeJob resources to run arbitrary commands on targeted edge nodes with the privileges of the edge upgrade process. Affected deployments are those running KubeEdge 1.12.0 through 1.21.1, 1.22.0/1.22.1, or 1.23.0 that actually process node-upgrade tasks; the vulnerability is high-priority and genuine rather than a CVSS-inflated finding, but it is gated on the NodeUpgradeJob create/update privilege (PR:L, not anonymous) so it is not reachable by unauthenticated users or on clusters that do not grant that permission. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS/KEV data were not supplied for this CVE. Vendor-released patches exist in 1.21.2, 1.22.2, and 1.23.1.
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that, on Windows edge nodes, can extract archive entries with parent-directory sequences, backslashes, absolute paths, or drive prefixes outside the intended destination. Exploitation requires the operator to run keadm join or installation using an archive obtained from a compromised, replaced, or untrusted download source, making this primarily a supply-chain trust-boundary bug rather than an attack against official artifacts. No public exploit was identified at time of analysis, and vendor fixes are released in 1.21.2, 1.22.2, and 1.23.1.
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Memory exhaustion in KubeEdge CloudHub (versions 1.0.0 through 1.21.1, 1.22.0 through 1.22.1, and 1.23.0) allows an authenticated, enrolled edge peer to terminate the cloud-side process or drive it into a restart loop by sending crafted viaduct frames whose 32-bit PackageHeader.PayloadLen declares a far larger payload than the frame contains. Impact is availability-only - no confidentiality or integrity loss and no code execution, which contradicts the single 'RCE' tag attached to the advisory; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5). There is no public exploit identified at time of analysis, and exploitation requires a valid edge-node credential or an established viaduct connection from a compromised node.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. Public exploit code available.
Authenticated command injection in KubeEdge (1.21.0 up to 1.21.2, 1.22.2, and 1.23.1) lets a principal holding Kubernetes RBAC rights to create or modify ConfigUpdateJob resources inject shell metacharacters into the updateFields passed to the keadm config-update command, which the edge taskmanager then runs through a system shell, yielding arbitrary command execution on the enrolled target edge node with the privileges of the KubeEdge process. The vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment is slightly more severe because compromise of the node process is a scope change (S:C); the PR:L vector confirms the attacker must be authenticated and authorized, so this is not anonymous or remotely unauthenticated abuse. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the flaw is a genuine, actionable CWE-78 issue rather than an inflated score, and it is fixed in KubeEdge 1.21.2, 1.22.2, and 1.23.1.
Shell command injection in KubeEdge's v1alpha2 NodeUpgradeJob upgrade workflow allows an authenticated user who holds RBAC permission to create or update NodeUpgradeJob resources to run arbitrary commands on targeted edge nodes with the privileges of the edge upgrade process. Affected deployments are those running KubeEdge 1.12.0 through 1.21.1, 1.22.0/1.22.1, or 1.23.0 that actually process node-upgrade tasks; the vulnerability is high-priority and genuine rather than a CVSS-inflated finding, but it is gated on the NodeUpgradeJob create/update privilege (PR:L, not anonymous) so it is not reachable by unauthenticated users or on clusters that do not grant that permission. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS/KEV data were not supplied for this CVE. Vendor-released patches exist in 1.21.2, 1.22.2, and 1.23.1.
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that, on Windows edge nodes, can extract archive entries with parent-directory sequences, backslashes, absolute paths, or drive prefixes outside the intended destination. Exploitation requires the operator to run keadm join or installation using an archive obtained from a compromised, replaced, or untrusted download source, making this primarily a supply-chain trust-boundary bug rather than an attack against official artifacts. No public exploit was identified at time of analysis, and vendor fixes are released in 1.21.2, 1.22.2, and 1.23.1.
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Memory exhaustion in KubeEdge CloudHub (versions 1.0.0 through 1.21.1, 1.22.0 through 1.22.1, and 1.23.0) allows an authenticated, enrolled edge peer to terminate the cloud-side process or drive it into a restart loop by sending crafted viaduct frames whose 32-bit PackageHeader.PayloadLen declares a far larger payload than the frame contains. Impact is availability-only - no confidentiality or integrity loss and no code execution, which contradicts the single 'RCE' tag attached to the advisory; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5). There is no public exploit identified at time of analysis, and exploitation requires a valid edge-node credential or an established viaduct connection from a compromised node.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. Public exploit code available.