---
id: "CVE-2026-62369"
kind: "vulnerability"
aliases: ["CVE-2026-62369", "GHSA-9vm9-pqxx-x83v", "GO-2026-6563"]
title: "KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge"
severity: "high"
cvss: 8.1
epss: 0.0062
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/kubeedge/kubeedge", "fixed": ["1.21.2", "1.22.2", "1.23.1"], "affected": ">= 1.23.0, < 1.23.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["edge-nodes", "go", "keadm", "kubeedge", "package", "windows"]
not_affected_if: ["keadm-not-used-for-join", "linux-only-edge-nodes", "trusted-download-source"]
published_at: "2026-09-21T18:17:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:45:34+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6563", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-62369", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62369", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge

KubeEdge's keadm tool fails to validate archive entry names when extracting during join or installation on Windows, so a crafted archive can write files outside the intended directory. An attacker who controls or replaces the download source can overwrite configuration, executables, or service files with keadm's privileges, leading to persistent modification or code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/kubeedge/kubeedge affected >= 1.23.0, < 1.23.1 fixed 1.21.2, 1.22.2, 1.23.1

## How to check

Check the keadm version on Windows edge nodes against the affected range (1.16.0 up to the fixed releases 1.21.2, 1.22.2, 1.23.1). The sources do not give a specific command or file to inspect.

## Fix

Upgrade keadm to 1.21.2, 1.22.2, or 1.23.1, matching your release line. Re-verify any Windows edge node that was joined from an untrusted or replaced archive.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6563
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-62369
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62369

## From the sources

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_