PT-2026-105578

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge...

EUVD-2026-84003

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API...

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

Impact The KubeEdge NodeUpgradeJob handler constructed the keadm upgrade edge command by concatenating the user-controlled spec.version and spec.image fields into a shell command. An authenticated user with permission to create or update NodeUpgradeJob resources through the v1alpha2 API could...

GHSA-5JPJ-293F-RHVJ KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

Impact The KubeEdge NodeUpgradeJob handler constructed the keadm upgrade edge command by concatenating the user-controlled spec.version and spec.image fields into a shell command. An authenticated user with permission to create or update NodeUpgradeJob resources through the v1alpha2 API could...