{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akubeedgekubeedge/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kubeedge:kubeedge:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-62369"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["keadm (\u003e= 1.16.0, \u003c 1.21.2)","keadm (\u003e= 1.22.0, \u003c 1.22.2)","keadm (\u003e= 1.23.0, \u003c 1.23.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","file-write","path-traversal","windows"],"_cs_type":"advisory","_cs_vendors":["KubeEdge"],"content_html":"\u003cp\u003eKubeEdge \u003ccode\u003ekeadm\u003c/code\u003e contains a path traversal vulnerability in its \u003ccode\u003eDecompressTarGz\u003c/code\u003e function, which is utilized during the edge node join and installation process. The vulnerability stems from the direct joining of archive entry names with the target destination path without sufficient validation. An attacker capable of providing a malicious \u003ccode\u003e.tar.gz\u003c/code\u003e archive can leverage path traversal components, Windows-style backslashes, absolute paths, or drive-prefixed paths to write or overwrite files outside the intended destination directory.\u003c/p\u003e\n\u003cp\u003eThis vulnerability (CVE-2026-62369) specifically impacts Windows environments where \u003ccode\u003ekeadm\u003c/code\u003e extracts component archives. Depending on the privileges of the user executing the \u003ccode\u003ekeadm\u003c/code\u003e command, an attacker can modify critical system files, including configuration files, executables, or service-related artifacts. Successful exploitation could lead to persistent system modification or unauthorized code execution. Mitigation requires upgrading to KubeEdge v1.21.2, v1.22.2, or v1.23.1, or ensuring that only trusted KubeEdge component archives are used during installation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an attacker to bypass directory constraints during archive extraction on Windows hosts. Depending on the targeted file, this can result in privilege escalation, system persistence, or full compromise of the affected edge node. This is particularly critical for administrative users or service accounts running \u003ccode\u003ekeadm\u003c/code\u003e with high-privilege context on Windows edge infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade KubeEdge to versions 1.21.2, 1.22.2, or 1.23.1 or later to implement secure file path validation in \u003ccode\u003eDecompressTarGz\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnforce strict supply chain controls by only utilizing official and verified KubeEdge package sources.\u003c/li\u003e\n\u003cli\u003eRestrict write permissions and administrative privileges for the service account or user executing the \u003ccode\u003ekeadm\u003c/code\u003e join process.\u003c/li\u003e\n\u003cli\u003eImplement integrity verification for all downloaded archives prior to triggering the \u003ccode\u003ekeadm\u003c/code\u003e extraction routines.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T01:55:26Z","date_published":"2026-09-23T01:55:26Z","id":"https://feed.craftedsignal.io/briefs/2026-09-kubeedge-path-traversal/","summary":"KubeEdge keadm utility contains a path traversal vulnerability (CVE-2026-62369) in its archive extraction function, allowing an attacker to overwrite arbitrary files on Windows systems during edge node join or installation.","title":"KubeEdge keadm Arbitrary File Write via Path Traversal","url":"https://feed.craftedsignal.io/briefs/2026-09-kubeedge-path-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kubeedge:kubeedge:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-62371"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["KubeEdge (v1.21.2, v1.22.2, v1.23.1)","kubeedge (v1.21.0 - 1.21.1, v1.22.0 - 1.22.1, v1.23.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","cloud-native","kubeedge"],"_cs_type":"advisory","_cs_vendors":["KubeEdge"],"content_html":"\u003cp\u003eKubeEdge versions within the 1.21.x, 1.22.x, and 1.23.x release branches contain a command injection vulnerability (CVE-2026-62371) affecting the NodeUpgradeJob resource handler within the v1alpha2 API. The vulnerability arises because the controller concatenates user-supplied values from the 'spec.version' and 'spec.image' fields directly into a shell string used to invoke 'keadm upgrade edge'. An attacker with the ability to create or update NodeUpgradeJob resources can inject shell metacharacters into these fields, resulting in arbitrary code execution on the target edge node with the privileges of the KubeEdge upgrade process. This issue represents a significant risk for deployments where API access is shared with untrusted entities, as it allows for container escape or host-level compromise of edge computing infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains authenticated access to the KubeEdge cluster with permissions to manage NodeUpgradeJob resources.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious payload using shell metacharacters (e.g., ';', '\u0026amp;\u0026amp;', or '$()').\u003c/li\u003e\n\u003cli\u003eThe attacker submits an update or create request to the v1alpha2 API for a NodeUpgradeJob resource.\u003c/li\u003e\n\u003cli\u003eThe malicious shell metacharacters are embedded within the 'spec.version' or 'spec.image' YAML fields.\u003c/li\u003e\n\u003cli\u003eThe KubeEdge controller processes the resource and dynamically builds the upgrade command using shell-based concatenation.\u003c/li\u003e\n\u003cli\u003eThe system executes the resulting command string via the OS shell, triggering the payload.\u003c/li\u003e\n\u003cli\u003eThe injected code executes on the target edge node, granting the attacker arbitrary command execution capabilities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-62371 grants authenticated attackers the ability to execute arbitrary commands on edge nodes. Given that edge nodes often operate in distributed environments with access to local hardware or sensitive data, this can lead to total node compromise, persistent backdooring of edge infrastructure, and lateral movement into the broader KubeEdge ecosystem. The vulnerability impacts KubeEdge deployments versions 1.12.0 through 1.23.0, excluding specific patched releases.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade KubeEdge instances to version 1.21.2, 1.22.2, or 1.23.1 to address CVE-2026-62371.\u003c/li\u003e\n\u003cli\u003eImplement strict Kubernetes Role-Based Access Control (RBAC) to limit the ability to create or update NodeUpgradeJob resources to authorized administrators only.\u003c/li\u003e\n\u003cli\u003eAudit cluster logs for unusual modifications to NodeUpgradeJob objects that include unexpected shell special characters in version or image fields.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T01:55:41Z","date_published":"2026-09-23T01:55:19Z","id":"https://feed.craftedsignal.io/briefs/2026-09-kubeedge-rce/","summary":"An authenticated remote code execution vulnerability (CVE-2026-62371) in the KubeEdge v1alpha2 API allows attackers to inject shell commands via the NodeUpgradeJob resource.","title":"Command Injection Vulnerability in KubeEdge NodeUpgradeJob","url":"https://feed.craftedsignal.io/briefs/2026-09-kubeedge-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kubeedge:kubeedge:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}