kubernetes security update (CVE-2026-19444)

The Kubernetes kubectl client has a path traversal vulnerability (CVE-2026-19444) in the 'kubectl cp' command on Windows platforms. When copying files from a container, kubectl runs the tar binary inside the container to create a tar archive, transfers it, and unpacks it locally. If the container's tar binary is malicious, it can execute arbitrary code and produce unexpected output, enabling an attacker controlling container contents to write files to arbitrary locations on the user's local machine, constrained only by the local user's permissions. This vulnerability affects kubectl clients on Windows versions prior to 1.29.1-19.oe2403sp1.

An attacker who controls container contents can exploit this vulnerability to write files to arbitrary paths on the local Windows machine when the 'kubectl cp' command is used. This could lead to arbitrary code execution or local system compromise, limited by the permissions of the local user running kubectl. The vulnerability does not affect non-Windows platforms.

A patch is available for this vulnerability. Users should upgrade their kubectl client to version 1.29.1-19.oe2403sp1 or later to remediate this issue. Until patched, users should exercise caution when using 'kubectl cp' with containers that may contain untrusted tar binaries, especially on Windows systems.