CVE-2026-82473
KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
| CWE | CWE-306 |
| Vendor | kubeedge |
| Product | kubeedge |
| Published | Aug 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for kubeedge kubeedge
Be the first to know when new high vulnerabilities affecting kubeedge kubeedge are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
kubeedge / kubeedge
0 ≤ 1.23.1
References
github.com: https://github.com/geo-chen/oss/blob/main/kubeedge.md github.com: https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/server.go github.com: https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/nodetask/report_status.go github.com: https://github.com/kubeedge/kubeedge vulncheck.com: https://www.vulncheck.com/advisories/kubeedge-cloudcore-through-1.23.1-missing-authentication-on-node-task-endpoints
Credits
George Chen