kubernetes security update (CVE-2026-19444)

The Kubernetes kubectl client has a path traversal vulnerability (CVE-2026-19444) in the 'kubectl cp' command on Windows platforms. When copying files from a container, kubectl runs the tar binary inside the container to create an archive, transfers it over the network, and unpacks it locally. If the container's tar binary is malicious, it can execute arbitrary code and produce unexpected output, enabling an attacker controlling the container contents to write files to arbitrary locations on the local machine, constrained only by the local user's permissions. This vulnerability affects kubectl clients running on Windows versions prior to 1.29.1-19.oe2403sp3.

An attacker who controls container contents can exploit this vulnerability to write files to arbitrary paths on the local Windows machine when the 'kubectl cp' command is used. This could lead to local code execution or unauthorized file modification, depending on the permissions of the local user running kubectl. The impact is limited to Windows clients and requires user interaction (invoking 'kubectl cp').

A patch is available for this vulnerability. Users should upgrade their kubectl client to version 1.29.1-19.oe2403sp3 or later to remediate this issue. Until patched, users should exercise caution when copying files from untrusted containers using 'kubectl cp' on Windows.