kubernetes security update (CVE-2026-19444)

The vulnerability (CVE-2026-19444) affects the Kubernetes kubectl client on Windows platforms when using the 'kubectl cp' command to copy files from a container. The command runs the tar binary inside the container to create an archive, which is then transferred and unpacked locally. If the tar binary inside the container is malicious, it can execute arbitrary code and produce unexpected output, enabling an attacker with control over container contents to write files to arbitrary paths on the local machine, constrained only by the local user's permissions. This issue is resolved in versions from 1.20.2-33.oe2203sp4 onward.

An attacker who controls the contents of a container can exploit this vulnerability to write files to arbitrary locations on the local Windows machine where kubectl is run, potentially leading to code execution or local system compromise. The impact is limited by the permissions of the local user running kubectl. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should upgrade their kubectl client to version 1.20.2-33.oe2203sp4 or later to mitigate this issue. No additional mitigation steps are specified.