Database/Container, Kubernetes & orchestration

KubeEdge CloudCore: unauthenticated node task status reports let anyone falsify node upgrade results

CVE-2026-82473Container, Kubernetes & orchestrationcurated

Impact

CloudCore's HTTPS server on port 10002 accepts node task status reports without verifying the caller's identity, so anyone who can reach that port can declare an upgrade job succeeded or failed for a node they do not own. The control plane's view of node state becomes attacker-controlled: a node can be recorded as upgraded when it was never touched, leaving stale driver, container-runtime or agent versions in a fleet the operator believes is current. The advisory also states that forged reports block further upgrade scheduling, so an attacker can wedge the upgrade pipeline for edge or remote GPU nodes and stall a rollout without touching the nodes themselves. Impact is on integrity of the orchestration control plane, not on node code execution - the record claims no confidentiality or code-execution effect.

Who can reach it

Any party with network reach to CloudCore's port 10002. No authentication and no user interaction required; exposure depends entirely on whether that port is restricted to the edge-node network or reachable more broadly.

What to do

The record names no fixed release - KubeEdge is described as affected through 1.23.1, and neither the VulnCheck advisory nor the linked source files identify a patched version. Until a fixed release lands, restrict reachability of CloudCore port 10002 to the edge nodes that legitimately report task status, using network policy, firewall rules or a service-mesh/mTLS boundary in front of CloudHub. Treat recorded node upgrade status as untrusted and verify component versions on the nodes themselves rather than from the control plane's job records. Mitigation is network-side and does not require draining nodes.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-82473 https://www.vulncheck.com/advisories/kubeedge-cloudcore-through-1.23.1-missing-authentication-on-node-task-endpoints https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/nodetask/report_status.go https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/server.go

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.