{"id":"CVE-2026-62369","kind":"vulnerability","aliases":["CVE-2026-62369","GHSA-9vm9-pqxx-x83v","GO-2026-6563"],"related":[],"title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge","description":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","summary":"KubeEdge's keadm tool fails to validate archive entry names when extracting during join or installation on Windows, so a crafted archive can write files outside the intended directory. An attacker who controls or replaces the download source can overwrite configuration, executables, or service files with keadm's privileges, leading to persistent modification or code execution.","severity":"high","cvss":8.1,"epss":0.0062,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/kubeedge/kubeedge","fixed":["1.21.2","1.22.2","1.23.1"],"affected":">= 1.23.0, < 1.23.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["edge-nodes","go","keadm","kubeedge","package","windows"],"not_affected_if":["keadm-not-used-for-join","linux-only-edge-nodes","trusted-download-source"],"how_to_check":"Check the keadm version on Windows edge nodes against the affected range (1.16.0 up to the fixed releases 1.21.2, 1.22.2, 1.23.1). The sources do not give a specific command or file to inspect.","fix":"Upgrade keadm to 1.21.2, 1.22.2, or 1.23.1, matching your release line. Re-verify any Windows edge node that was joined from an untrusted or replaced archive.","status":"open","published_at":"2026-09-21T18:17:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:34+00:00","updated_at":"2026-10-23T21:45:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:45:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade keadm to 1.21.2, 1.22.2, or 1.23.1, matching your release line. Re-verify any Windows edge node that was joined from an untrusted or replaced archive.","reach":"network","impact":"high","summary":"KubeEdge's keadm tool fails to validate archive entry names when extracting during join or installation on Windows, so a crafted archive can write files outside the intended directory. An attacker who controls or replaces the download source can overwrite configuration, executables, or service files with keadm's privileges, leading to persistent modification or code execution.","category":"package","who_cares":["kubeedge","keadm","windows","edge-nodes","go"],"confidence":0.8,"needs_auth":"no","worst_case":"Arbitrary file write on Windows edge node, possibly code execution","analyst_note":"Sources conflict on affected range: products field says >=1.23.0 <1.23.1, description says from 1.16.0 until the fixed versions; check the GHSA or NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-62369 for the true range.","how_to_check":"Check the keadm version on Windows edge nodes against the affected range (1.16.0 up to the fixed releases 1.21.2, 1.22.2, 1.23.1). The sources do not give a specific command or file to inspect.","needs_analyst":true,"not_affected_if":["linux-only-edge-nodes","trusted-download-source","keadm-not-used-for-join"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000924,"input_tokens":3160,"output_tokens":1215,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A,32A '-62369':22A,33A '-6563':30A '/kubeedge/kubeedge':19A,36A '1.16.0':119C '1.21.2':121C,218C '1.22.2':122C,219C '1.23.1':124C,221C '9vm9':25A 'absolut':171C 'affect':184C 'applic':111C 'arbitrari':7A 'archiv':52B,66B,131C,151C 'attack':75B 'backslash':170C 'capabl':113C 'code':99B,210C 'compon':166C 'compromis':155C 'configur':85B,199C 'consequ':188C 'contain':162C 'container':110C 'control':77B 'craft':65B 'cve':20A,31A 'decompresstargz':3A,126C 'destin':137C 'directori':73B,165C,182C 'download':81B,159C 'drive':175C 'drive-prefix':174C 'edg':13A,38B,117C,148C 'edge-nod':37B 'enabl':6A,205C 'entri':53B,132C 'escap':179C 'execut':86B,100B,200C,211C 'extend':108C 'extract':56B,136C 'fail':49B 'file':8A,69B,89B,192C,203C 'fix':215C 'function':127C 'ghsa':24A 'ghsa-9vm9-pqxx-x83v':23A 'github.com':18A,35A 'github.com/kubeedge/kubeedge':17A,34A 'go':28A,40B 'host':115C 'influenc':152C 'instal':60B,145C 'intend':72B,181C 'issu':213C 'join':15A,58B,130C,143C 'keadm':2A,41B,47B,91B,142C,185C 'keadm/cmd/keadm/app/cmd/util/common.go':129C 'kubeedg':1A,42B,45B,101C 'lead':94B 'modif':97B,208C 'modifi':198C 'name':54B,133C 'nativ':109C 'node':14A,39B,149C 'open':104C 'orchestr':112C 'outsid':70B 'overwrit':84B,191C 'packag':43B 'parent':164C 'parent-directori':163C 'path':4A,172C,177C 'persist':96B,206C 'potenti':197C 'pqxx':26A 'prefix':176C 'privileg':93B,196C 'process':186C 'replac':79B,156C 'servic':88B,202C 'sourc':82B,105C,160C 'style':169C 'suffici':139C 'system':106C,207C 'tool':48B 'travers':5A 'untrust':158C 'valid':51B,140C 'version':217C 'window':11A,44B,62B,147C,168C 'windows-styl':167C 'without':138C 'write':9A,68B,189C 'x83v':27A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T18:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6563","url":"https://pkg.go.dev/vuln/GO-2026-6563","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62369","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62369","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62369","severity":null,"published_at":"2026-09-21T18:17:09+00:00","modified_at":"2026-09-24T23:17:14+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}