Vulnerability Description
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/geo-chen/oss/blob/main/kubeedge.md
- https://github.com/kubeedge/kubeedge
- https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/htt
- https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/htt
- https://www.vulncheck.com/advisories/kubeedge-cloudcore-through-1.23.1-missing-a
FAQ
What is CVE-2026-82473?
CVE-2026-82473 is a vulnerability with a CVSS score of 8.2 (HIGH). KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeede...
How severe is CVE-2026-82473?
CVE-2026-82473 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82473?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.