CVE-2026-15687: Path traversal via non-tar copyDirectoryFromPod
A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15687?
The severity of CVE-2026-15687 is classified as low, with a score of 2.7.
How does CVE-2026-15687 exploit path traversal?
CVE-2026-15687 allows a compromised pod to create new files in arbitrary locations by leveraging the non-tar copyDirectoryFromPod function.
What are the consequences of CVE-2026-15687?
The consequences of CVE-2026-15687 include the potential for unauthorized file creation on the client machine.
How do I fix CVE-2026-15687?
To mitigate CVE-2026-15687, enable tar compressing during copy operations by setting enableTarCompressing to true.
Which software is affected by CVE-2026-15687?
CVE-2026-15687 affects the Kubernetes Java client library.