Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T17:17:37.150Z",
  "pubdate": "2026-09-21T17:17:37.150Z",
  "executiveSummary": "A command injection vulnerability exists within the KubeEdge v1alpha2 NodeUpgradeJob handler, specifically located in the edge/pkg/taskmanager/actions/nodeupgradejob.go file.\nThe vulnerability allows authenticated users with permissions to create or update NodeUpgradeJob resources to execute arbitrary shell commands on targeted edge nodes.\nBy injecting shell metacharacters into the spec.version or spec.image fields, an attacker can bypass intended command execution constraints.\nSuccessful exploitation grants the attacker the same privileges as the upgrade process, resulting in full compromise of the edge node's confidentiality, integrity, and availability.\nThis issue impacts KubeEdge versions 1.12.0 through 1.21.1, 1.22.1, and 1.23.0.\nMitigation requires upgrading to the patched versions 1.21.2, 1.22.2, or 1.23.1 to ensure proper input sanitization and secure execution of the keadm upgrade edge command.",
  "technicalDetails": "The vulnerability resides in the processing logic of the NodeUpgradeJob resource, which is handled by the component located at edge/pkg/taskmanager/actions/nodeupgradejob.go. The root cause is the improper handling of user-supplied input when constructing shell commands for the node upgrade process.\nSpecifically, the application takes the 'spec.version' and 'spec.image' fields from the NodeUpgradeJob resource and directly concatenates these strings into the keadm upgrade edge shell command without adequate validation, sanitization, or parameterization. Because the system relies on shell execution to perform node upgrades, these fields act as direct injection vectors for arbitrary shell commands.\nAn attacker possessing the necessary permissions to create or modify NodeUpgradeJob objects can craft a malicious payload containing shell metacharacters (e.g., ;, &&, ||, backticks, or $()). When the NodeUpgradeJob is processed by the task manager, the injected payload is interpreted by the host shell rather than being treated as a literal argument to the keadm binary.\nThe attack flow follows these steps: 1) The attacker authenticates to the KubeEdge control plane; 2) The attacker submits a crafted NodeUpgradeJob resource containing malicious shell syntax in the version or image fields; 3) The KubeEdge edge controller receives the resource and triggers the upgrade task; 4) The nodeupgradejob.go handler constructs the keadm command using the unvalidated input; 5) The resulting string is executed in a system shell on the target edge node; 6) The operating system evaluates the metacharacters, leading to the execution of the attacker's secondary commands.\nThis vulnerability is particularly dangerous because it grants the attacker code execution at the privilege level of the upgrade process, which typically requires high-level system permissions. The impact is a full compromise of the node, allowing for data exfiltration, service disruption, or persistent malware installation.\nThe vulnerability affects versions 1.12.0 up to 1.21.1, 1.22.1, and 1.23.0. Authentication is required to interact with the KubeEdge API and create/update resources, and the attacker must have sufficient RBAC permissions to manipulate NodeUpgradeJob resources, making this an authenticated remote code execution attack."
}