CVE-2026-62182

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

• CWE-78

• https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md
• https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md
• https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md
• https://github.com/kubeedge/kubeedge/commit/14f65fc6207787f266cbcb0dceac7f09a81bab2b
• https://github.com/kubeedge/kubeedge/commit/6309a335c8e5e3c154b6bb0a09292f5c7dc598dc
• https://github.com/kubeedge/kubeedge/commit/ee78415a36911c1a93e59a921c23b8e4ecd83e90
• https://github.com/kubeedge/kubeedge/pull/7028
• https://github.com/kubeedge/kubeedge/pull/7029
• https://github.com/kubeedge/kubeedge/pull/7030
• https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2
• https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2
• https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1
• https://github.com/kubeedge/kubeedge/security/advisories/GHSA-m3c6-2p7h-cfr3

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62174Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62175Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62177Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62178Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6218A vulnerability was found in aandrew-me ytDownloader up to 3…5.3
• CVE-2026-62180Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62183Improper Privilege Management vulnerability in Apache Syncop…9.8
• CVE-2026-62184luci-app-banip contains a log parsing vulnerability where th…8.7
• CVE-2026-62185Argo CD Helm Chart before 10.0.0 fails to install network po…8.6
• CVE-2026-62186OpenClaw versions before 2026.6.8 contain an authorization b…7.6
• CVE-2026-62187OpenClaw Feishu tools (npm package @openclaw/feishu) in vers…8.6
• CVE-2026-62188OpenClaw @openclaw/feishu versions 2026.6.6 and earlier cont…8.6