KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
CVE-2026-62369
This high-severity CVE scores 8.1 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.9%, top 43% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.1
- EG Score
- 8.1(medium)
- EG Risk
- 37(Track)EG Risk 37/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity81% × 45%Exploitation1% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 1%
- EPSS %ILE
- 57%
- KEV
- Not listed
Published
September 21, 2026
Last Modified
September 24, 2026
Advisory Details (10)
Auto-updated Sep 21, 2026kubeedge/CHANGELOG/CHANGELOG-1.23.md at master · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.mdkubeedge/CHANGELOG/CHANGELOG-1.22.md at master · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.mdkubeedge/CHANGELOG/CHANGELOG-1.21.md at master · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.mdcommit ee02dea9d081 (kubeedge/kubeedge)
Fix landed in kubeedge/kubeedge commit ee02dea9d081 — awaiting tagged release
https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40commit a524a66a1ae1 (kubeedge/kubeedge)
Fix landed in kubeedge/kubeedge commit a524a66a1ae1 — awaiting tagged release
https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047commit 47767b7f2649 (kubeedge/kubeedge)
Fix landed in kubeedge/kubeedge commit 47767b7f2649 — awaiting tagged release
https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d[release-1.21] Backport security hardening fixes for v1.21.2
Fix merged in kubeedge/kubeedge PR #7030 on 2026-07-15 — awaiting tagged release
https://github.com/kubeedge/kubeedge/pull/7030[release-1.22] Backport security hardening fixes for v1.22.2
Fix merged in kubeedge/kubeedge PR #7029 on 2026-07-15 — awaiting tagged release
https://github.com/kubeedge/kubeedge/pull/7029[release-1.23] Backport security hardening fixes for v1.23.1
Fix merged in kubeedge/kubeedge PR #7028 on 2026-07-15 — awaiting tagged release
https://github.com/kubeedge/kubeedge/pull/7028keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join · Advisory · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83vVendor Advisories for CVE-2026-62369(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(1 across 1 ecosystem)
Go(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| github.com/kubeedge/kubeedge | — | 1.21.2 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 9× in last 7d / 9× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-24 23:38 UTCEG score recompute
- 2026-09-24 22:37 UTCEG score recompute
- 2026-09-24 14:11 UTCEG score recompute
- 2026-09-24 02:44 UTCEG score recompute
- 2026-09-23 17:54 UTCEPSS rescore
- 2026-09-22 16:59 UTCEG score recompute
- 2026-09-21 18:27 UTCEG score recompute
- 2026-09-21 17:25 UTCEG score recompute
- 2026-09-21 17:25 UTCMITRE cvelistV5first tracked
Related CVEs(same product + same CWE)
Same product
10 shownGo:github.com/kubeedge/kubeedge
Frequently asked(5)
What is CVE-2026-62369?
When was CVE-2026-62369 disclosed?
Is CVE-2026-62369 actively exploited?
What is the CVSS score of CVE-2026-62369?
How do I remediate CVE-2026-62369?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-62369
Is Your Infrastructure Affected by CVE-2026-62369?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.