Bug 2542443 (CVE-2026-19444)

Summary: CVE-2026-19444 k8s.io/kubectl: Kubernetes kubectl: Arbitrary file write via path traversal on Windows
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akhatavk, akoudelk, alebedev, alizardo, amctagga, anjoseph, anpicker, ansmith, aoconnor, aos-team-art-private, aprice, asdas, asegurap, bniver, bparees, bsquizza, cahl, cmitchel, crizzo, dbosanac, dfreiber, dhanak, dkeler, doconnor, dpaolell, drosa, drow, dschmidt, dsimansk, dymurray, eborisov, efried, eglynn, elicohen, flucifre, gbenhaim, gmeno, gparvin, groman, gtanzill, hasun, hoberger, ibolton, ikhan, jbalunas, jbritton, jburrell, jbuscemi, jcantril, jchui, jdelft, jfula, jhe, jjoyce, jlanda, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jreimann, jsamir, jschluet, jupierce, kaycoth, kbempah, kingland, kshier, ktsao, lball, lberk, lbragsta, lgamliel, lgarciaa, lhh, ljawale, lpele, mbenjamin, mbiarnes, mburns, mdessi, mgarciac, mhackett, mkleinhe, mnovotny, mold, mrizzi, mrunge, msilmser, nboldt, ngough, niyer, nyancey, oaljalju, oezr, ometelka, pakotvan, pcattana, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rbobbitt, rekumar, rhaigner, rjohnson, rojacob, sakbas, sarad, sausingh, sbratsla, sdawley, sghai, sidsharm, simaishi, slucidi, solenoci, sostapov, sprizend, sseago, stcannon, sthirugn, suppawar, syedriko, thason, tsze, twaugh, vereddy, veshanka, vimartin, vkumar, vlaad, vvoronko, wenshen, whayutin, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Kubernetes kubectl. An attacker controlling a container can write arbitrary files to the host system when a user copies files from the container. Because the tool does not properly validate file paths when extracting archives on Windows, a malicious container can traverse directories and overwrite local files with the permissions of the user executing the command.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-28 11:51:25 UTC 
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary in the container is malicious, it can execute arbitrary code and emit unexpected output, allowing an attacker who controls container contents to write files to arbitrary paths on the user's local machine when kubectl cp is invoked, limited only by the system permissions of the local user. This issue only affects kubectl clients running on Windows.