CVE-2026-82473

KubeEdge CloudCore through version 1.23.1 accepts node task status reports on its HTTPS server without verifying authentication (CWE-306, Missing Authentication for Critical Function). An attacker who can reach CloudCore on port 10002 can submit forged reports that mark node upgrade jobs as succeeded or failed. This deceives the control plane about actual node upgrade status and can block or derail further upgrade scheduling, an integrity impact on upgrade task data with no effect on confidentiality. Any KubeEdge deployment running CloudCore 1.23.1 or earlier is affected, with the greatest risk where port 10002 is reachable from untrusted networks. No exploitation is currently known: there is no public proof of concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days.

What to do: Restrict network access to CloudCore port 10002 to trusted cluster components using firewall rules, security groups, or network policies, and review recent node upgrade task statuses for forged success/failure reports. Upgrade CloudCore to the first patched release after 1.23.1 as soon as one is published, since the advisory data does not yet name a fixed version. Monitor KubeEdge and VulnCheck channels for patch availability, PoC releases, and any addition to CISA KEV.