Is CVE-2026-82473 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82473 being exploited in the wild.

How severe is CVE-2026-82473?

High severity, with a CVSS score of 8.2, published 29 August 2026.

Which products and versions are affected?

KubeEdge CloudCore through 1.23.1.

Is there a fix for CVE-2026-82473?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82473 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82473?

Check whether you run KubeEdge CloudCore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82473: KubeEdge CloudCore authentication bypass in node task status endpoints

CVE-2026-82473 · Severity: high · CVSS 8.2 · Published 2026-08-29

KubeEdge CloudCore is the control-plane component that manages edge computing nodes in Kubernetes-based deployments. An attacker who can reach CloudCore's port 10002 can forge task completion events (upgrade success/failure, configuration updates) without credentials, allowing them to deceive the control plane about node upgrade status, block future upgrades, and potentially inject false completion events for any managed node in the cluster.

Vendors: KubeEdge.

Quick answers

Is CVE-2026-82473 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82473 being exploited in the wild.
How severe is CVE-2026-82473?: High severity, with a CVSS score of 8.2, published 29 August 2026.
Which products and versions are affected?: KubeEdge CloudCore through 1.23.1.
Is there a fix for CVE-2026-82473?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82473 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82473?: Check whether you run KubeEdge CloudCore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in KubeEdge CloudCore's HTTP handlers for /nodeupgrade and /task/{taskType}/name/{taskID}/node/{nodeID}/status POST endpoints. These endpoints accept and process task-completion events without verifying caller identity (bearer token or client certificate), while an adjacent /edge.crt endpoint on the same server correctly enforces authentication. An attacker with network access to CloudCore's port 10002 can inject forged upgrade-success events to leave nodes on outdated versions, mark upgrades as permanently failed to block future scheduling, and enumerate registered node names. The root cause is the absence of an authentication filter on the nodetask route handlers in cloud/pkg/cloudhub/servers/httpserver/server.go. The recommended fix is to apply the same bearer-token or client-certificate verification used by EdgeCoreClientCert to the affected endpoints.

Affected products

KubeEdge CloudCore through 1.23.1

Timeline

2026-05-27: disclosed
2026-08-28: advisory
2026-08-29: other: CVE-2026-82473 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.