Authentication Bypass in KubeEdge CloudCore Node Task Reporting

KubeEdge CloudCore versions up to 1.23.1 are susceptible to an authentication bypass vulnerability. The CloudCore component exposes an HTTPS server on port 10002 that fails to properly verify the authenticity of incoming node task status reports. An unauthenticated attacker with network access to this port can submit crafted requests to the control plane, masquerading as a node. By injecting false success or failure status messages for node upgrade jobs, an attacker can deceive the control plane's state machine. This manipulation disrupts the orchestration logic, effectively causing a denial of service regarding the automated scheduling and execution of future node upgrades within the KubeEdge cluster. The issue represents a significant risk to environment management and fleet maintenance operations.

Impact

Successful exploitation allows an unauthorized party to disrupt cluster management operations by poisoning the status of node upgrade tasks. This results in the blocking of legitimate upgrade schedules across the affected KubeEdge deployment, potentially leaving nodes running outdated, vulnerable, or incompatible software versions. While no massive data breach is immediately associated with this vulnerability, the loss of control over cluster state management poses a high impact to system availability and maintenance integrity in environments relying on KubeEdge for automated lifecycle management.

Recommendation

Prioritize the immediate mitigation of the vulnerability identified in CVE-2026-82473.

• Upgrade KubeEdge CloudCore to a version greater than 1.23.1 immediately to incorporate the necessary authentication checks for task status reports.
• Restrict network access to CloudCore port 10002. Only trusted edge node communication paths should be permitted to reach this port at the network layer.
• Implement host-based or network-level firewall policies to prevent unauthorized subnets or external entities from reaching the management interface of the CloudCore service.