This vulnerability (CVE-2026-62369) specifically impacts Windows environments where keadm extracts component archives. Depending on the privileges of the user executing the keadm command, an attacker can modify critical system files, including configuration files, executables, or service-related artifacts. Successful exploitation could lead to persistent system modification or unauthorized code execution. Mitigation requires upgrading to KubeEdge v1.21.2, v1.22.2, or v1.23.1, or ensuring that only trusted KubeEdge component archives are used during installation.

Impact

The vulnerability allows an attacker to bypass directory constraints during archive extraction on Windows hosts. Depending on the targeted file, this can result in privilege escalation, system persistence, or full compromise of the affected edge node. This is particularly critical for administrative users or service accounts running keadm with high-privilege context on Windows edge infrastructure.

Recommendation

• Upgrade KubeEdge to versions 1.21.2, 1.22.2, or 1.23.1 or later to implement secure file path validation in DecompressTarGz.
• Enforce strict supply chain controls by only utilizing official and verified KubeEdge package sources.
• Restrict write permissions and administrative privileges for the service account or user executing the keadm join process.
• Implement integrity verification for all downloaded archives prior to triggering the keadm extraction routines.

Attack Chain

1. An attacker gains authenticated access to the KubeEdge cluster with permissions to manage NodeUpgradeJob resources.
2. The attacker crafts a malicious payload using shell metacharacters (e.g., ';', '&&', or '$()').
3. The attacker submits an update or create request to the v1alpha2 API for a NodeUpgradeJob resource.
4. The malicious shell metacharacters are embedded within the 'spec.version' or 'spec.image' YAML fields.
5. The KubeEdge controller processes the resource and dynamically builds the upgrade command using shell-based concatenation.
6. The system executes the resulting command string via the OS shell, triggering the payload.
7. The injected code executes on the target edge node, granting the attacker arbitrary command execution capabilities.

Impact

Successful exploitation of CVE-2026-62371 grants authenticated attackers the ability to execute arbitrary commands on edge nodes. Given that edge nodes often operate in distributed environments with access to local hardware or sensitive data, this can lead to total node compromise, persistent backdooring of edge infrastructure, and lateral movement into the broader KubeEdge ecosystem. The vulnerability impacts KubeEdge deployments versions 1.12.0 through 1.23.0, excluding specific patched releases.

Recommendation

1. Upgrade KubeEdge instances to version 1.21.2, 1.22.2, or 1.23.1 to address CVE-2026-62371.
2. Implement strict Kubernetes Role-Based Access Control (RBAC) to limit the ability to create or update NodeUpgradeJob resources to authorized administrators only.
3. Audit cluster logs for unusual modifications to NodeUpgradeJob objects that include unexpected shell special characters in version or image fields.