[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes

As cited

Copy frozen at 2026-09-28 18:31 UTC (site build).

vulnerabilities

[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes

A path traversal vulnerability in Kubernetes kubectl cp command on Windows allows a malicious tar binary in a container to write files to arbitrary paths on a user's local machine, constrained only by the user's file permissions. The issue is assigned CVE-2026-19444 and rated Medium severity with a CVSS score of 6.5.

Why it matters: Kubernetes administrators and developers using kubectl cp on Windows systems need to assess whether they run containers from untrusted sources, as a compromised container could write malicious files to their workstations.

Source published

2026-09-28 11:44 UTC

First seen by Cybersecurity Tracker

2026-09-28 16:06 UTC