Path Traversal Vulnerability in Kubernetes kubectl Client for Windows

CVE-2026-19444

What is CVE-2026-19444?

A path traversal vulnerability has been identified in the Kubernetes kubectl client's cp command on Windows systems. This vulnerability occurs when copying files from a container where the tar binary may be compromised. As a result, an attacker controlling the container contents can execute arbitrary code on the local machine of the user invoking the command. This ability to write files to arbitrary paths is hazardous, as it is limited only by the local user's system permissions, exposing systems to potential data breaches and unauthorized access.

References