Description

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-29T17:17:59.770Z",
  "pubdate": "2026-08-29T17:17:59.770Z",
  "executiveSummary": "KubeEdge CloudCore, in versions up to and including 1.23.1, is susceptible to an authentication bypass vulnerability within its HTTPS-based node task reporting mechanism.\nThe vulnerability resides in the server's failure to enforce mandatory identity verification for incoming node status reports directed at port 10002.\nAn unauthenticated, network-adjacent attacker can leverage this flaw to interact directly with the CloudCore service to manipulate upgrade job states.\nBy submitting unauthorized requests, an attacker can falsely signal the success or failure of node upgrades, effectively deceiving the control plane.\nThe primary risk implication is the disruption of cluster maintenance workflows, specifically the orchestration of node upgrades.\nThis vulnerability allows an attacker to block further upgrade scheduling by placing the control plane in an inconsistent or stalled state.\nExploitation requires network reachability to the CloudCore HTTPS port 10002, but does not require any pre-existing credentials or privileged access to the KubeEdge environment.\nThis represents a significant integrity risk to cluster management operations and operational continuity.",
  "technicalDetails": "The vulnerability is classified as an Improper Authentication flaw where the KubeEdge CloudCore service fails to validate the provenance and authorization of incoming HTTPS requests sent to the node task status reporting endpoint.\nSpecifically, the CloudCore service exposes a service interface on port 10002 intended for processing status reports regarding node upgrade tasks. In affected versions (through 1.23.1), the implementation of this handler lacks a check to verify that the request originates from an authenticated and authorized source.\nThe attack flow begins with an attacker identifying a network path to the CloudCore instance on port 10002. Because the endpoint does not require client-side certificate validation or token-based authentication, an attacker can craft arbitrary HTTPS POST requests that mimic the structure of a legitimate node task status update.\nBy crafting a payload that contains specific parameters indicating the success or failure of an upgrade job, the attacker can force the CloudCore to update the internal state of a managed node within the control plane database.\nThe malicious payload directly influences the decision-making process of the KubeEdge control plane. If an attacker submits a response marking an upgrade as 'failed' or 'succeeded' prematurely, the scheduler's logic regarding maintenance windows and sequential node upgrades is compromised.\nIn a post-exploitation scenario, the attacker effectively achieves a denial-of-service on the orchestration pipeline. Since the control plane perceives an upgrade job as blocked or completed based on the forged input, it will cease further automated upgrade attempts for the target node, creating a state of stale configuration. This manipulation bypasses the safety checks that typically ensure node updates proceed in a controlled and verified sequence, leading to potential operational disruption or an inability to patch critical vulnerabilities on managed nodes.\nThe vulnerability is intrinsic to the server-side logic of the HTTPS endpoint handler in the CloudCore component. The lack of cryptographic verification of the source of the report ensures that any entity with network access to the port can impersonate the node agent or a legitimate reporting entity, demonstrating a complete breakdown of trust for this specific administrative function."
}