---
id: CVE-2026-82473
title: >-
  KubeEdge CloudCore through 1.23.1 accepts node task status reports on its
  HTTPS server without authentication verification
summary: >-
  KubeEdge CloudCore through 1.23.1 accepts node task status reports on its
  HTTPS server without authentication verification. Attackers can reach
  CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving
  the control pl…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-306
published: '2026-08-29'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82473'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/kubeedge.md'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/kubeedge/kubeedge'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/nodetask/report_status.go
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/httpserver/server.go
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/kubeedge-cloudcore-through-1.23.1-missing-authentication-on-node-task-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0064
epssPercentile: 0.48445
ingestedAt: '2026-08-30T12:52:23.995Z'
---

## Overview

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.