KubeEdge CloudCore 1.23.1 Auth Bypass on HTTPS Node Status API
CVE-2026-82473 Published on August 29, 2026
KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Vulnerability Analysis
CVE-2026-82473 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-82473
Want to know whenever a new CVE is published for Linux Foundation Kubeedge? stack.watch will email you.
Affected Versions
kubeedge:- Before and including 1.23.1 is affected.