Skip to content
Fencer Vulns
medium 6.5

CVE-2026-19444 json

Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

published 2026-09-28 42 d ago modified 2026-09-29 40 d ago also EUVD-2026-88223

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary in the container is malicious, it can execute arbitrary code and emit unexpected output, allowing an attacker who controls container contents to write files to arbitrary paths on the user's local machine when kubectl cp is invoked, limited only by the system permissions of the local user. This issue only affects kubectl clients running on Windows.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-19444 updated cvss 6.5

k8s.io/kubectl: Kubernetes kubectl: Arbitrary file write via path traversal on Windows

  • Red Hat DPU kit for NVIDIA dpu-kit-for-nvidia/must-gather-rhel10 Red Hat Multicluster Engine for Kubernetes multicluster-engine/registration-rhel9 Red Hat OpenShift Container Platform 4 openshift-clients, openshift4/ose-cli-artifacts-rhel9 Red Hat OpenShift Container Platform 5 openshift-clients, openshift5/ose-cli-artifacts-rhel9
    affected: workaround, no fix available
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-controller-rhel9, assisted/agent-preinstall-image-builder-rhel9 Red Hat AWS Load Balancer Operator albo/aws-load-balancer-controller-rhel8 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-waiters-rhel10, openshift-builds/openshift-builds-webhook-rhel10, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, +10 more Red Hat Compliance Operator compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle, compliance/openshift-compliance-must-gather-rhel8 Red Hat Confidential Compute Attestation build-of-trustee/trustee-must-gather-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-must-gather-rhel9, openshift-sandboxed-containers/osc-podvm-builder-rhel9
    not affected: vulnerable code not present
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator
    not affected: component not present
  • Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator
    not affected: vulnerable code not in execute path
  • Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-rhel9-operator, kmm/kernel-module-management-must-gather-rhel9, kmm/kernel-module-management-hub-rhel9-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operator Red Hat Logical Volume Manager Storage lvms4/lvms-must-gather-rhel8, lvms4/lvms-must-gather-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat MCP Server for Red Hat OpenShift openshift-mcp-beta/openshift-mcp-server-rhel9, openshift-mcp-tech-preview/openshift-mcp-server-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-rhel9-operator
    +7 more products
    Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operator, rhmtc/openshift-migration-log-reader-rhel8, rhmtc/openshift-migration-must-gather-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-must-gather-rhel8, migration-toolkit-virtualization/mtv-must-gather-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel9, multicluster-engine/work-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/must-gather-rhel9, multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-8-rhel8, +10 more Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-must-gather-rhel8, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel9-operator, workload-availability/node-maintenance-operator-bundle, container-native-virtualization/node-maintenance-operator Red Hat OpenShift API for Data Protection oadp/oadp-mustgather-rhel9 Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel8, ocp-tools-4/jenkins-agent-base-rhel9
    not affected: vulnerable code not present
  • Red Hat OpenShift Lightspeed openshift-lightspeed/openshift-mcp-server-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Serverless openshift-serverless-1/serverless-must-gather-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/acm-must-gather-rhel9, rhacm2/rbac-query-proxy-rhel9, rhacm2/metrics-collector-rhel9, rhacm2/volsync-operator-bundle, rhacm2/submariner-rhel9-operator, +9 more Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-roxctl-rhel9, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-rhel9-operator, +3 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/ee-supported-rhel8, ansible-automation-platform-24/ee-supported-rhel9, ansible-automation-platform-25/ee-supported-rhel8, ansible-automation-platform-25/ee-supported-rhel9, ansible-automation-platform-26/ee-supported-rhel9, ansible-automation-platform-26/hub-rhel9-operator, +24 more
    not affected: vulnerable code not present
  • Red Hat Build of Kueue kueue/kueue-must-gather-rhel9
    not affected: vulnerable code not in execute path
show 3 more
  • Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, rhcertification/redhat-certification-baremetal Red Hat Developer Hub 1 rhdh/rhdh-must-gather-rhel9 Red Hat Edge Manager 1 flightctl, rhem/flightctl-api-rhel9, rhem/flightctl-api-rhel10, rhem/flightctl-worker-rhel9, rhem/flightctl-worker-rhel10, rhem/flightctl-db-setup-rhel9, +19 more
    not affected: vulnerable code not present
  • Red Hat Hardened Images helm4 4.3.0-0.2.hum1, helm3 3.22.0-0.2.hum1, trivy 0.74.0-0.3.hum1, kubernetes1.35 1.35.8-3.hum1, kubernetes1.36 1.36.4-2.hum1
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/rhai-cli-rhel9, rhoai/odh-must-gather-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-kueue-controller-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9, +22 more Red Hat OpenShift Container Platform 4 cri-tools, openshift, microshift, microshift-olm, kata-containers, microshift-sriov, +195 more Red Hat OpenShift Container Platform 5 cri-tools, openshift, microshift, openshift-kni/commatrix, openshift5/ose-cli-rhel9, openshift5/cnf-tests-rhel9, +81 more
    not affected: vulnerable code not present

14 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
41 d ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.