CVE-2026-62369

Executive Summary

CVE-2026-62369 is a path traversal (Zip/Tar Slip) vulnerability in KubeEdge's DecompressTarGz function located in keadm/cmd/keadm/app/cmd/util/common.go. It affects KubeEdge releases from 1.16.0 up to (but not including) 1.21.2, 1.22.2, and 1.23.1, and is exploitable when keadm join or keadm installation runs on Windows edge nodes and extracts an archive sourced from a compromised, replaced, or otherwise untrusted download location. Successful exploitation allows the keadm process to write or overwrite arbitrary files with its own privileges — potentially configuration, executable, or service files — enabling persistent host modification or code execution. CVSS v3.1 base score is 8.1 (High), reflecting high integrity and availability impact with user interaction required.

Technical Analysis

The vulnerability resides in KubeEdge's edge-node provisioning tooling (keadm). The affected function, DecompressTarGz, is responsible for extracting .tar.gz archives during keadm join or installation workflows. The NVD description states that this function "joins archive entry names to the extraction destination without sufficient validation."

This is the canonical CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) pattern, sometimes referred to in archive-extraction contexts as "Zip Slip" / "Tar Slip." The core mechanism is:

1. An archive is constructed that contains one or more entries whose names are not confined to the intended extraction root. Per the description, the malicious entry names can include:
   • Parent-directory components (e.g., ../ traversal),
   • Windows-style backslashes (path-separator confusion on Windows),
   • Absolute paths,
   • Drive-prefixed paths (e.g., a Windows drive letter followed by a path).
2. When DecompressTarGz processes each entry, it concatenates the entry name onto the extraction destination without normalizing, canonicalizing, or rejecting entries that resolve outside the destination directory.
3. Because the extraction runs inside the keadm process, any file written inherits keadm's privileges.

On Windows edge nodes, the platform-specific handling of both forward slashes and backslashes — combined with drive-letter semantics — makes traversal and cross-volume writes easier to construct than on a POSIX host.

The issue is scoped by the description to Windows edge nodes and requires that the archive be "influenced through a compromised, replaced, or untrusted download source." No public proof-of-concept, Nuclei template, or exploit code is available as of this report. The attack chain below is therefore inferred at the vulnerability-class level rather than from published exploit artifacts.

The affected version bounds and the fix versions are the only concrete code-version facts available; no commit hash, advisory URL, or CVE-numbered vendor bulletin is present in the supplied data.

Exploitation Scenarios

No public PoC available; attack chain is inferred from the vulnerability class (CWE-22 archive extraction).

1. Reconnaissance / target identification. An adversary identifies a Windows host that will run or is running keadm join (or the corresponding keadm installation path). Such hosts are edge nodes being onboarded into a KubeEdge cluster. The relevant precondition per the advisory is that the archive fetched by keadm is retrievable from — or can be substituted at — a download source that is compromised, replaced, or untrusted. This can include a hijacked mirror, an intercepted/manipulated download channel, or an internally controlled staging location.

2. Triggering the flaw class. The adversary crafts a .tar.gz archive whose entry names contain traversal sequences tailored to Windows path semantics: parent-directory components, backslash-based separators, absolute paths, or drive-prefixed paths. When keadm runs and DecompressTarGz extracts the archive, the unvalidated joins cause entries to be written outside the intended extraction directory.

3. Payload / execution method. No specific payload format is documented. At the vulnerability-class level, the attacker's objective is file-write primitive: place or overwrite files in locations the attacker cannot otherwise reach under keadm's privilege level. Because the write retains keadm's privileges, plausible targets are configuration, executable, or service files — the categories explicitly named in the advisory. Overwriting a service binary or a service definition is the mechanism through which the write primitive converts to persistent execution; the specific filenames and paths are not provided in the source data and must not be assumed.

4. Post-exploitation impact. Per the advisory, the result is "persistent system modification or code execution." Persistence is achieved because the overwritten artifact (configuration, executable, or service file) is loaded by the operating system on subsequent boots or service restarts. From the edge node, the adversary gains a foothold inside the KubeEdge-managed environment, which sits between the cloud control plane and the edge workload.

The critical enabling condition is supply/delivery compromise of the archive. This makes the attack highly targeted and non-opportunistic: a network-only attacker cannot trigger it without first controlling or substituting the archive source. CVSS reflects this with UI:R (user interaction) and AV:N.

Impact Assessment

• Confidentiality (C:N — None). The primitive is a write operation; no read/exfiltration capability is described.
• Integrity (I:H — High). Arbitrary file write/overwrite of configuration, executable, or service files with keadm's privileges.
• Availability (A:H — High). Overwriting service or system files can render the edge node inoperable or its services non-functional.
• Scope (S:U — Unchanged). The impact is confined to the security authority of the keadm process and the host it runs on.
• Attack Vector/Complexity (AV:N / AC:L). Network-delivered archive with no special complexity once the delivery source is controlled.
• Privileges Required (PR:N), User Interaction (UI:R). No prior auth required, but an operator must run the keadm workflow.

Blast radius: Windows edge nodes onboarded via keadm with an untrusted or compromised archive source. Because KubeEdge edge nodes often run in physically exposed or lightly monitored environments (factory floors, retail, remote sites), persistence established there may evade centralized controls. A compromised edge node is also a pivot toward the KubeEdge cloud side and workloads it manages. There is no evidence of mass exploitation; CISA KEV does not list this CVE and no EPSS score has been published.

Detection Guidance

Sigma Rule

title: KubeEdge keadm Archive Extraction Write Outside Destination (Tar Slip)
id: 6c1e8e2a-1f3d-4b7a-9c2e-0d5a7f9b3e11
status: experimental
description: Detects keadm process activity indicative of archive extraction outside the intended destination directory (CVE-2026-62369), including writes to sensitive Windows paths and service-related files.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62369
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\keadm.exe'
  selection_paths:
    TargetFilename|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
      - '\ProgramData\'
      - '\Program Files\KubeEdge\'
      - '\Program Files (x86)\KubeEdge\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.conf'
      - '.yaml'
      - '.yml'
  condition: selection_proc and selection_paths and selection_ext
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate KubeEdge installation/upgrade writing to its own directories
level: high
tags:
  - attack.t1195.002
  - attack.initial_access
  - cve.2026-62369

YARA Rule

rule CVE_2026_62369_KubeEdge_TarSlip_Archive
{
    meta:
        author      = "valtersit.com"
        description = "Detects tar.gz archives crafted for CVE-2026-62369 (KubeEdge DecompressTarGz path traversal) containing parent-directory, backslash, or drive-prefixed entry names"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-62369"
        date        = "2026-01-01"
        severity    = "high"

    strings:
        $tar_magic  = { 1F 8B }
        $trav_fwd   = "../"
        $trav_back  = "..\\"
        $drive_a    = "C:\\"
        $drive_b    = "D:\\"
        $abs_unc    = "\\\\"

    condition:
        $tar_magic at 0 and
        ( $trav_fwd or $trav_back or $drive_a or $drive_b or $abs_unc )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-62369 KubeEdge keadm Archive Download From External Source (Potential Tar-Slip Delivery)"; flow:established,to_client; http.method; content:"GET"; http.uri; content:".tar.gz"; http.response_body; content:"|1F 8B|"; classtype:attempted-user; reference:cve,2026-62369; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62369; sid:202662369; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, created_by valtersit.com;)

Elastic Detection

file where process.name == "keadm.exe" and
  file.extension : ("exe", "dll", "bat", "cmd", "ps1", "conf", "yaml", "yml") and
  file.path :
    ("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*", "*\\ProgramData\\*",
     "*\\Program Files\\KubeEdge\\*", "*\\Program Files (x86)\\KubeEdge\\*")

Splunk SPL Query

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where Image LIKE "%\\keadm.exe"
| where match(TargetFilename, "(?i)(\\\\Windows\\\\System32\\\\|\\\\Windows\\\\SysWOW64\\\\|\\\\ProgramData\\\\|\\\\Program Files\\\\KubeEdge|\\\\Program Files \(x86\)\\\\KubeEdge)")
| where match(TargetFilename, "(?i)\.(exe|dll|bat|cmd|ps1|conf|ya?ml)$")
| eval risk="CVE-2026-62369 Tar-Slip possible archive extraction"
| table _time, ComputerName, User, Image, TargetFilename, risk
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,kubeedge,">
  <rule id="100690" level="12">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.image">\\keadm\.exe$</field>
    <field name="win.eventdata.targetFilename">(?i)(\\Windows\\System32\\|\\Windows\\SysWOW64\\|\\ProgramData\\|\\Program Files\\KubeEdge\\|\\Program Files \(x86\)\\KubeEdge\\)</field>
    <field name="win.eventdata.targetFilename">(?i)\.(exe|dll|bat|cmd|ps1|conf|ya?ml)$</field>
    <description>CVE-2026-62369: keadm wrote an executable or config file outside its installation path (possible tar-slip path traversal)</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
    <group>cve_2026_62369,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Do not run keadm join or keadm installation workflows on Windows edge nodes using archives from untrusted, third-party, or unverified download sources. Only extract archives from the official KubeEdge release channel obtained over an authenticated channel.
   • Verify archive integrity cryptographically (vendor-published checksums / signatures) before invoking keadm. Reject any archive whose origin cannot be verified.
   • Where feasible, run keadm under a least-privilege account rather than an account with broad write access to System32, ProgramData, or service directories, to limit the reach of an arbitrary-write primitive.
   • Restrict outbound egress from edge-node provisioning hosts so that an attacker cannot substitute the download source.

2. Patch / upgrade steps

   • Upgrade KubeEdge to 1.21.2, 1.22.2, or 1.23.1 (or later). These are the versions stated in the advisory as containing the fix.
   • After upgrading, re-run provisioning only with verified official archives.
   • Because no patch reference or commit hash was supplied with the source data, obtain the authoritative fix artifact and release notes directly from the KubeEdge project.

3. Long-term hardening

   • Adopt a policy that archive extraction during provisioning normalizes canonical paths and rejects entries containing parent-directory components, backslashes, absolute paths, or drive-prefixed paths before any write.
   • Pin and sign provisioning artifacts in CI/CD; mandate signature verification on edge nodes.
   • Monitor Windows edge nodes for file writes by keadm outside its own installation tree (see detection rules above).
   • Track the KubeEdge security advisory channel for a formal CVE fix announcement and KEV status.

References

• NVD — CVE-2026-62369: https://nvd.nist.gov/vuln/detail/CVE-2026-62369
• KubeEdge project documentation / release notes (versions 1.21.2, 1.22.2, 1.23.1): https://github.com/kubeedge/kubeedge/releases
• KubeEdge security advisories: https://github.com/kubeedge/kubeedge/security/advisories
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-62369 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template was available at the time of writing. No EPSS score has been published. CISA KEV does not list this CVE. No threat-actor campaign or in-the-wild exploitation evidence was identified in the supplied data.