Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck
CVE-2026-82473KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
High 8.2
In plain English
A high-severity missing authentication in kubeedge from kubeedge. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 49.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
References
- https://github.com/geo-chen/oss/blob/main/kubeedge.md technical-description, exploit
- https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/server.go technical-description
- https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/nodetask/report_status.go technical-description
- https://github.com/kubeedge/kubeedge product
- VulnCheck Advisory: KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints third-party-advisory