---
id: "CVE-2026-62182"
kind: "vulnerability"
aliases: ["CVE-2026-62182", "GHSA-m3c6-2p7h-cfr3", "GO-2026-6573"]
title: "KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge"
severity: "high"
cvss: 8.8
epss: 0.00476
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/kubeedge/kubeedge", "fixed": ["1.21.2", "1.22.2", "1.23.1"], "affected": ">= 1.23.0, < 1.23.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["edge-nodes", "go", "kubeedge", "kubernetes", "package"]
not_affected_if: ["version-1.21.2-or-later", "version-1.22.2-or-later", "version-1.23.1-or-later", "version-below-1.21.0"]
published_at: "2026-09-21T18:17:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:56+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6573", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-62182", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62182", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge

KubeEdge's ConfigUpdateJob handler builds a shell command from user-supplied updateFields values without escaping, so shell metacharacters run as commands. An attacker who can create or edit a ConfigUpdateJob runs arbitrary commands on the enrolled edge node with the privileges of the KubeEdge process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/kubeedge/kubeedge affected >= 1.23.0, < 1.23.1 fixed 1.21.2, 1.22.2, 1.23.1

## How to check

Check the KubeEdge version on edge nodes and the control plane with the kubeedge version command or the image tag in use.
List ConfigUpdateJob resources with kubectl get configupdatejobs -A and review who can create or update them.

## Fix

Upgrade to KubeEdge 1.21.2, 1.22.2, or 1.23.1 depending on the release line in use.
Until patched, restrict create and update permissions on ConfigUpdateJob resources to trusted users.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6573
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-62182
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62182

## From the sources

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_