https://seclists.org/oss-sec/2026/q3/960: [kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes
Affected Software
Frequently Asked Questions
Which users and workflows are exposed?
The issue affects users running the kubectl client on Windows who use kubectl cp to copy files from a container whose contents they do not fully control. Linux and macOS kubectl clients are not affected.
What does an attacker need to exploit this?
An attacker needs control of a tar binary in a container that the Windows user copies files from with kubectl cp. The malicious tar can write to arbitrary local paths, constrained by the permissions of the local user running kubectl.
How can I determine whether my client is affected?
Run kubectl version --client and compare the client version to the affected ranges: v1.34.0 through v1.34.11, v1.35.0 through v1.35.8, and v1.36.0 through v1.36.4.
What can I do before upgrading?
Do not use kubectl cp on Windows to copy files from untrusted containers. If copying is necessary, only copy from containers whose contents you trust.
Which versions contain the fix?
Upgrade kubectl to v1.34.12 or later, v1.35.9 or later, or v1.36.5 or later, as applicable to your release line.