CVE-2026-19444

Name of the Vulnerable Software and Affected Versions kubectl (affected versions not specified)

Description A path traversal issue exists in the kubectl cp command for clients running on Windows. When copying files from a container, the client executes the tar binary within the container to create an archive, which is then transferred and unpacked on the local machine. If the tar binary inside the container is malicious, it can generate unexpected output that allows an attacker controlling the container contents to write files to arbitrary paths on the local user's machine, subject to the local user's system permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.