KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes API

Impact

REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes API object. The ConfigUpdateJob handler concatenated caller-supplied updateFields values into a command string and ran it through a system shell, so shell metacharacters in a configuration field execute as commands on every targeted node with the privileges of the KubeEdge process. For anyone running distributed inference on edge or far-edge GPU boxes, the practical picture is that a namespaced RBAC grant intended to let a team push configuration turns into node-level execution across the fleet — and the fleet is the part of the estate with the least physical oversight and the weakest chance of anyone noticing.

Who can reach it

Network, authenticated: the attacker needs RBAC permission to create or update ConfigUpdateJob resources and an enrolled target edge node. No user interaction beyond the job being processed.

What to do

Upgrade to KubeEdge 1.23.1, 1.22.2 or 1.21.2, where keadm config-update is invoked with structured arguments and the whole --set value is passed as a single literal. Before that lands, restrict RBAC on ConfigUpdateJob to trusted administrators, avoid ConfigUpdateJob where the input cannot be fully trusted, and monitor edge-node process activity for unexpected commands.

References