Executive brief
KubeEdge CloudCore is the control-plane component that manages edge computing nodes in Kubernetes-based deployments. An attacker who can reach CloudCore's port 10002 can forge task completion events (upgrade success/failure, configuration updates) without credentials, allowing them to deceive the control plane about node upgrade status, block future upgrades, and potentially inject false completion events for any managed node in the cluster.
Technical details
The vulnerability is an authentication bypass in KubeEdge CloudCore's HTTP handlers for /nodeupgrade and /task/{taskType}/name/{taskID}/node/{nodeID}/status POST endpoints. These endpoints accept and process task-completion events without verifying caller identity (bearer token or client certificate), while an adjacent /edge.crt endpoint on the same server correctly enforces authentication. An attacker with network access to CloudCore's port 10002 can inject forged upgrade-success events to leave nodes on outdated versions, mark upgrades as permanently failed to block future scheduling, and enumerate registered node names. The root cause is the absence of an authentication filter on the nodetask route handlers in cloud/pkg/cloudhub/servers/httpserver/server.go. The recommended fix is to apply the same bearer-token or client-certificate verification used by EdgeCoreClientCert to the affected endpoints.
Affected products
- KubeEdge CloudCore through 1.23.1
Timeline
- 2026-05-27: disclosed
- 2026-08-28: advisory
- 2026-08-29: other: CVE-2026-82473 published