Description
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Published: 2026-08-29
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

KubeEdge CloudCore versions up to 1.23.1 allow unauthenticated HTTPS requests to the node task status reporting endpoint. The endpoint accepts status updates for upgrade jobs, and an attacker can craft messages that mark an upgrade as succeeded or failed without a real upgrade occurring. This misleads the control plane into believing the node is in a different state, potentially blocking future upgrades or causing the control plane to perform actions based on false status information. The vulnerability arises from a lack of authentication (CWE-306).

Affected Systems

KubeEdge (Linux Foundation) CloudCore, version 1.23.1; the affected product is the CloudCore component that handles node task status reporting.

Risk and Exploitability

The CVSS score of 8.8 indicates a high impact vulnerability. EPSS data is not available, leaving the exploitation probability uncertain, yet the lack of authentication means the endpoint can be reached by any actor with network connectivity to port 10002. The vulnerability is not yet listed in the CISA KEV catalog, implying no confirmed exploits, but the attack vector is remote network access to the device, allowing any uncontrolled user to send status updates.

Generated by OpenCVE AI on August 29, 2026 at 17:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade KubeEdge to a fixed release that enforces authentication on node task status endpoints.
  • Restrict network access to the CloudCore HTTPS endpoint on port 10002 so that only trusted cluster components can reach it, applying firewall or network segmentation rules.
  • Monitor CloudCore logs for unexpected task status updates and audit node upgrade events for anomalies that may indicate spoofed status reports.

Generated by OpenCVE AI on August 29, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Title KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
First Time appeared Linuxfoundation
Linuxfoundation kubeedge
Weaknesses CWE-306
CPEs cpe:2.3:a:linuxfoundation:kubeedge:*:*:*:*:*:*:*:*
Vendors & Products Linuxfoundation
Linuxfoundation kubeedge
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Linuxfoundation Kubeedge
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-29T16:35:33.159Z

Reserved: 2026-08-29T14:11:13.911Z

Link: CVE-2026-82473

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-29T17:17:59.770

Modified: 2026-08-29T17:17:59.770

Link: CVE-2026-82473

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T17:30:12Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function