Summary
CVE-2026-82473 is a missing-authentication vulnerability (CWE-306) in KubeEdge CloudCore through version 1.23.1. CloudCore’s HTTPS server accepts node task status reports — including node upgrade job status — without verifying the caller’s identity, allowing any network-reachable attacker to submit forged status reports. The issue is rated HIGH severity (8.8).
Technical details
- Root cause: CloudCore’s HTTP(S) server processes node task status report requests without any authentication or authorization check.
- Trigger condition: An attacker only needs network access to the CloudCore task-reporting endpoint on port 10002; no credentials or user interaction are required.
- Attack vector: Network (AV:N), low attack complexity, no privileges or user interaction needed.
- Impact: Attackers can submit crafted status reports to falsely mark node upgrade jobs as succeeded or failed, corrupting the control plane’s view of node upgrade state and disrupting/blocking scheduled node upgrades across the edge fleet.
Affected software
- KubeEdge CloudCore, all versions through 1.23.1
Severity
- CVSS v4.0: 8.8 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- CVSS v3.1: 8.2 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Mitigation and recommended actions
- Immediate: No fixed release version has been publicly confirmed as of this writing; check the official KubeEdge GitHub Security Advisories page for an updated CloudCore release that adds authentication to the node task status reporting endpoint, and upgrade as soon as one is available.
- If no patch is available: Restrict network access to CloudCore’s task-reporting service (port 10002) to trusted edge nodes and administrative networks only — do not expose it to the public internet. Use network segmentation, firewall rules, or a mutual-TLS/VPN boundary to limit reachability, and monitor for unsolicited or anomalous requests to the node-task status endpoint, correlating status changes against expected node-side upgrade logs and agent telemetry.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- TLS certificate:
KubeEdgein the certificate subject organization, subject common name, issuer organization, and issuer common name fields.

