kubernetes security update (CVE-2026-19444)

CVE-2026-19444 is a path traversal vulnerability in the Kubernetes kubectl client's 'kubectl cp' command on Windows. When copying files from a container, kubectl uses the tar binary inside the container to create an archive that is transferred and unpacked locally. If the tar binary inside the container is malicious, it can execute arbitrary code and produce unexpected output, enabling an attacker controlling container contents to write files to arbitrary locations on the local Windows machine, constrained by the local user's permissions. This vulnerability affects kubectl clients on Windows versions prior to 1.29.1-19.oe2403sp4.

An attacker who controls the contents of a container can exploit this vulnerability to write files to arbitrary paths on the local Windows machine where kubectl is run. This could lead to arbitrary code execution on the local system with the privileges of the local user invoking kubectl. The impact is limited to kubectl clients running on Windows and depends on the permissions of the local user.

A patch is available for this vulnerability. Users should upgrade their kubectl client to version 1.29.1-19.oe2403sp4 or later to remediate this issue. Until patched, avoid using 'kubectl cp' on Windows with untrusted containers.