[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes

Summary by Cyber Security News28 Sep 2026, 13:44 CEST

About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/960

Posted by Vyom Yadav on Sep 28 Hello Kubernetes Community, A security issue was discovered in Kubernetes where a malicious tar binary in a container may be able to write files to arbitrary paths on the local machine of a user running kubectl cp on Windows, limited only by the permissions of the local user. This issue has been rated *Medium* (CVSS calculator: https://www.first.org/cvss/calculator/3.1) (score 6.5), and assigned *CVE-2026-19444*. *Am I vulnerable?* You are...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 3

[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion

28th September – Threat Intelligence Report

Attack Surface Management in 2026: Why Point-in-Time Scans Can’t Keep Up With Cloud Sprawl

Other users can watch your browsing and time your keystrokes through OS file notifications

CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)