CVE-2026-62369 in KubeEdge
Summary
by MITRE • 09/21/2026
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within the KubeEdge project represents a critical path traversal flaw located specifically in the DecompressTarGz function found in the keadm utility component. This issue affects versions ranging from 1.16.0 through various subsequent releases up to but not including the patched versions, encompassing 1.21.2, 1.22.2, and 1.23.1 as fixed points. The core technical deficiency lies in the insufficient validation of archive entry names during the extraction process. When keadm is utilized for joining or installing on Windows edge nodes, it processes compressed archives that may originate from compromised repositories, replaced packages, or untrusted download sources. In these scenarios, an attacker can craft a malicious archive containing file paths designed to escape the intended target directory structure.
The technical mechanism of exploitation relies on the improper handling of path separators and relative navigation sequences within the extracted files. Specifically, the vulnerable function fails to adequately sanitize entries that contain parent-directory components such as dot-dot-slash sequences or Windows-style backslashes. Furthermore, it does not properly restrict absolute paths or drive-prefixed paths which are valid in Windows environments but dangerous when processed without strict boundary checks. By leveraging these malformed path strings within a tar.gz archive, an attacker can direct the extraction process to write files outside of the designated installation directory. This lack of input validation allows for arbitrary file placement on the underlying operating system filesystem rather than confining writes to the expected application sandbox or configuration folder.
The operational impact of this vulnerability is severe due to the privileges under which the keadm process typically operates during node initialization and joining procedures. Since the extraction occurs with elevated permissions, an attacker who controls the content of a downloaded archive can overwrite critical system files, modify existing configurations, replace executable binaries, or install new services. This capability effectively grants persistent system modification rights and facilitates arbitrary code execution on the edge node. The compromise extends beyond simple data leakage; it enables full control over the edge device, which serves as a gateway for broader Kubernetes cluster operations. An attacker could establish persistence mechanisms that survive reboots or integrate malicious logic into legitimate services to maintain long-term access within the network perimeter.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-22, known as Improper Limitation of a Pathname to a Restricted Directory, which describes situations where software does not properly neutralize special elements in file paths that can resolve to unintended directories. Additionally, from an offensive security perspective mapped against the MITRE ATT&CK framework, this flaw supports techniques related to Defense Evasion and Persistence through arbitrary file writes and service manipulation. The exploitation vector is primarily categorized under Supply Chain Compromise or Untrusted Data Source interaction, as it requires the victim node to process a maliciously crafted archive obtained from an untrusted origin during standard operational workflows like joining a cluster.
Mitigation strategies must prioritize immediate upgrading of the KubeEdge installation utilities to patched versions that address this path traversal issue. For environments where upgrade is not immediately feasible, strict validation of all incoming archives should be implemented at the network perimeter or package management layer before they reach the edge nodes. Administrators should enforce integrity checks using cryptographic signatures for all downloaded components and restrict keadm execution privileges where possible to minimize the blast radius in case of exploitation. Furthermore, implementing file system monitoring on critical directories can aid in detecting unauthorized write attempts resulting from such path traversal attacks. Ensuring that only trusted sources are used for node joining artifacts is essential to preventing this class of vulnerability from being exploited in production environments.