Kubeedge vulnerabilities
We track 5 vulnerabilities in Kubeedge products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Kubeedge vulnerabilities
- 8.1 High severity
kubeedge: Improper Limitation of a Pathname to a Restricted Directory
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive ent
- 8.8 High severity
kubeedge: Improper Neutralization of Special Elements used in an OS Command
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenat
- 8.8 High severity
kubeedge: Improper Neutralization of Special Elements used in an OS Command
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go co
- 8.2 High severity
kubeedge: Missing Authentication for Critical Functionality
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade
- 7.5 High severity
kubeedge: Uncontrolled Resource Consumption
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the ServiceBus server on the edge side may be susceptible to a DoS attack if an HTTP requ