Executive brief
KubeEdge is a Kubernetes-based edge computing platform that extends cloud native capabilities to edge nodes. An authenticated attacker with permissions to create or update node upgrade jobs could inject shell commands through user-controllable fields, leading to remote code execution on edge nodes with the privileges of the upgrade process, potentially compromising node confidentiality, integrity, and availability.
Technical details
This is a command injection vulnerability in the NodeUpgradeJob handler where the version and image fields are concatenated into a shell command string without proper escaping or argument separation. An authenticated user can include shell metacharacters (e.g., backticks, pipes, semicolons) in the spec.version or spec.image fields when creating or updating NodeUpgradeJob resources via the v1alpha2 API. When the upgrade job is processed, the injected commands are executed on the targeted edge node with the privileges of the keadm upgrade process. The fix eliminates shell-based command construction by using exec.Command with a structured argument list, ensuring version and image values are passed as literal arguments rather than being interpreted by the shell.
Affected products
- KubeEdge KubeEdge before v1.23.1, v1.22.2, v1.21.2
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: v1.23.1, v1.22.2, v1.21.2