Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T18:17:09.420Z",
  "pubdate": "2026-09-21T18:17:09.420Z",
  "executiveSummary": "KubeEdge is susceptible to a command injection vulnerability due to improper input sanitization within the ConfigUpdateJob processing logic. The vulnerability exists in the edge/pkg/taskmanager/actions/configupdatejob.go file, where user-supplied updateFields are insecurely concatenated into system shell commands.\nAn authenticated user possessing permissions to create or modify ConfigUpdateJob resources can inject arbitrary shell metacharacters into the command strings. This allows for remote code execution on the target edge node with the privileges of the KubeEdge process, typically root or high-privilege service accounts.\nThe vulnerability affects KubeEdge versions 1.21.0 through 1.21.2, 1.22.2, and 1.23.1. Successful exploitation results in full compromise of the edge node, potentially allowing the attacker to intercept data, pivot into internal networks, or disrupt edge computing workloads. Remediation requires upgrading to the specified patched versions to ensure input validation and secure command execution practices.",
  "technicalDetails": "The vulnerability originates in the ConfigUpdateJob processing workflow located in edge/pkg/taskmanager/actions/configupdatejob.go. The system is designed to handle edge node configurations via the keadm utility. During the execution of a ConfigUpdateJob, the application takes user-controlled input from the 'updateFields' field of the resource definition.\nThe root cause is the insecure construction of shell commands, where the application concatenates these unsanitized user-controlled fields directly into a string executed by a system shell. Because the application does not validate or sanitize these inputs for shell metacharacters (e.g., semicolons, backticks, or pipe symbols), an attacker can break out of the intended command context.\nExploitation requires an attacker to have the necessary permissions to create or modify a ConfigUpdateJob resource within the KubeEdge cluster. The attack flow is as follows: First, the attacker defines a malicious ConfigUpdateJob resource manifest. Inside the 'updateFields' section, the attacker crafts a payload that includes shell metacharacters followed by a malicious command (e.g., '; rm -rf / ;' or a reverse shell payload). When the KubeEdge task manager processes this job, it interprets the concatenated string as a single command line to be executed by the shell.\nBecause the KubeEdge process runs with the privileges of the system service, the injected command is executed with those same privileges. This leads to arbitrary command execution on the enrolled edge node. The impact is critical, as it bypasses intended functional constraints of the configuration management utility, enabling full administrative control over the node's operating system environment. There is no requirement for direct network exposure beyond the ability to interact with the Kubernetes API to submit the configuration job, making this an authenticated, privilege-based attack vector.\nAffected versions include 1.21.0 through 1.21.2, 1.22.2, and 1.23.1. The fix implemented in the updated versions involves replacing the direct shell string concatenation with secure execution practices, such as using parameterized command arguments that prevent the shell from interpreting user input as command separators or shell operators."
}