VulnSocial

CVE-2026-62182Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-21: 1Mentions · 2026-10-16: 1Patch / Workaround · 2026-10-16: 1Technical Details · 2026-10-16: 109-2110-16
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-211
Disclosure1
2026-10-161
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-62182: KubeEdge command injection, CVSS 8.8. Authenticated users with ConfigUpdateJob access can run shell commands via unescaped updateFields. Patch still under review - restrict access and mitigate now. https://www.valtersit.com/cve/CVE-2026-62182/ #CVE #infosec #KubeEdge #KubeEdge #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet announces CVE-2026-62182, a KubeEdge command injection vulnerability with CVSS 8.8, provides technical details including the attack vector, and recommends restricting access as a workaround while a patch is under review.

    0001057
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-62182 KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.… https://www.cve.org/CVERecord?id=CVE-2026-62182

    Post summary

    The post announces CVE‑2026‑62182 affecting KubeEdge versions 1.21.0 through 1.21.2 and 1.22.2, linking to the official CVE record without providing exploit details, patches, or evidence of active exploitation.

    00000915
    58.1K followersView on X

Explore more

Back to dashboard