CVE-2026-82473
KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
- State
- Published
- Severity
- 8.8 High
- Published
- Aug 29, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 29, 2026
Description
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
kubeedgekubeedge |
|
References
- https://github.com/geo-chen/oss/blob/main/kubeedge.mdtechnical-descriptionexploit
- https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/server.gotechnical-description
- https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/nodetask/report_status.gotechnical-description
- https://github.com/kubeedge/kubeedgeproduct
- VulnCheck Advisory: KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.