Is CVE-2026-62369 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62369 being exploited in the wild.

How severe is CVE-2026-62369?

High severity, with a CVSS score of 8.1, published 21 September 2026.

Which products and versions are affected?

github.com/kubeedge/kubeedge (Go) SEMVER:introduced=1.16.0,fixed=1.21.2, SEMVER:introduced=1.16.0,fixed=1.21.2,introduced=1.22.0,fixed=1.22.2,introduced=1.23.0,fixed=1.23.1; KubeEdge Keadm before 1.21.2, 1.22.x before 1.22.2, 1.23.x before 1.23.1.

Is there a fix for CVE-2026-62369?

Yes. github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62369 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-62369?

Check whether you run github.com/kubeedge/kubeedge (Go) or KubeEdge Keadm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62369: KubeEdge keadm path traversal in DecompressTarGz

CVE-2026-62369 · Severity: high · CVSS 8.1 · Published 2026-09-21

KubeEdge's keadm installation tool contains a path traversal vulnerability in its archive extraction function that could allow attackers to write files outside the intended directory. During edge node installation or joining on Windows systems, a malicious tar.gz archive could be used to overwrite system files, configuration files, or executables, potentially leading to unauthorized system modification or remote code execution if the keadm process runs with elevated privileges.

Technologies: github.com/kubeedge/kubeedge (Go). Vendors: Go, KubeEdge.

Quick answers

Is CVE-2026-62369 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62369 being exploited in the wild.
How severe is CVE-2026-62369?: High severity, with a CVSS score of 8.1, published 21 September 2026.
Which products and versions are affected?: github.com/kubeedge/kubeedge (Go) SEMVER:introduced=1.16.0,fixed=1.21.2, SEMVER:introduced=1.16.0,fixed=1.21.2,introduced=1.22.0,fixed=1.22.2,introduced=1.23.0,fixed=1.23.1; KubeEdge Keadm before 1.21.2, 1.22.x before 1.22.2, 1.23.x before 1.23.1.
Is there a fix for CVE-2026-62369?: Yes. github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62369 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-62369?: Check whether you run github.com/kubeedge/kubeedge (Go) or KubeEdge Keadm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later
```
go get github.com/kubeedge/kubeedge@v1.23.1
```

Technical details

The vulnerability exists in the DecompressTarGz function, which extracts tar.gz archives without properly validating archive entry names. Archive entries containing parent-directory traversal components (..), Windows-style backslashes, absolute paths, or drive-prefixed paths can cause files to be written outside the intended extraction directory. The attack vector is network-adjacent or local, requiring the attacker to influence the contents of an archive processed by keadm (e.g., through a compromised download source). Successful exploitation allows arbitrary file write with the privileges of the keadm process, which on Windows could enable persistence and code execution. The fix involves path normalization, validation of entry names, and use of secure path joining to ensure extracted files remain within the destination directory. Patches are available for versions 1.23.1, 1.22.2, and 1.21.2.

Affected products

KubeEdge keadm before 1.21.2, 1.22.x before 1.22.2, 1.23.x before 1.23.1

Identifiers

CVE-2026-62369
GHSA-9vm9-pqxx-x83v
GO-2026-6563

Timeline

2026-09-22: disclosed
2026-09-22: patched: Patches available for v1.23.1, v1.22.2, v1.21.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.