CVE-2026-19444

Executive Summary

CVE-2026-19444 is a path traversal vulnerability (CWE-22) in the Kubernetes kubectl cp client command on Windows. When kubectl cp copies files from a container, it invokes tar inside the container to build an archive, transfers it over the network, and unpacks it locally; if the container's tar binary is malicious, it can execute arbitrary code and emit crafted output that causes the local unpacking step to write files to arbitrary paths on the user's machine. The impact is limited to kubectl clients running on Windows, with severity scored at CVSS 6.5 (Medium). An attacker who already controls container contents can leverage this to write files to arbitrary local paths, constrained only by the permissions of the local user running kubectl.

Technical Analysis

This vulnerability is a classic path traversal (zip-slip / tar-slip class) weakness, but with an important trust-boundary twist unique to the Kubernetes kubectl cp workflow on Windows.

The kubectl cp data flow. According to the NVD description, kubectl cp, when copying files from a container, operates in three distinct stages:

1. Archive creation (remote): kubectl runs tar inside the container to build a tar archive of the requested source path. This means the archiving operation executes on a host the attacker may influence or control.
2. Transfer (network): The resulting tar archive is streamed over the Kubernetes API connection back to the client.
3. Extraction (local): The client unpacks the received archive onto the user's local filesystem.

Where the weakness lives. The vulnerability arises at the intersection of stages 1 and 3. Because the tar binary executing in stage 1 is provided by the container image, an attacker who controls container contents can supply a malicious tar binary. Rather than producing a normal, well-formed archive, that binary can emit arbitrary output — most notably tar entries whose stored file names contain path traversal sequences (e.g., ../../). When the local client extracts the archive in stage 3, the traversal segments are not neutralized, so files can be written to paths outside the intended extraction directory.

The NVD description explicitly states the malicious tar "can execute arbitrary code and emit unexpected output." The "arbitrary code" execution occurs container-side (the malicious binary runs inside the container as the remote archiver), while the impact on the victim is the file-write primitive on the local Windows host, achieved through the crafted archive output.

Why Windows-only. The advisory explicitly scopes the issue to kubectl clients "running on Windows." This indicates the local extraction logic on Windows handles archive member paths in a way that does not correctly confine writes to the destination directory — a platform-specific path-handling defect. Non-Windows clients are documented as unaffected. The precise Windows path-parsing behavior responsible is not detailed in the provided description, and no implementation specifics (function names, code paths) are available from the tracked sources; the assessment above is confined to the archive-write mechanism that the description does describe.

Trust boundary. The core security lesson is a violated trust assumption: kubectl cp implicitly trusts the remote tar binary to produce a benign archive. In a multi-tenant or untrusted-image environment, that assumption fails. The adversary does not need to compromise the client directly — they only need to control the container the user chooses to copy from.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None, Nuclei template: NO, Exploit Code: NO). The attack chain below is inferred strictly from the vulnerability class described in the NVD advisory.

1) Reconnaissance / target identification. The attacker positions a malicious tar binary within a container image, or otherwise gains the ability to control the tar binary (or its search path) inside a running container that a victim will later read from. The attacker then induces, or waits for, a user on a Windows machine to run kubectl cp against that container to copy files from it to the local host. The preconditions per the CVSS vector are significant: the attack requires adjacency on the affected network segment (AV:A), and the attacker is positioned with high privileges (PR:H) in the environment where the malicious container/tar resides.

2) Triggering the flaw class. When the victim executes kubectl cp to pull files from the attacker-controlled container, the client invokes the container's tar binary to create the archive. Because that binary is malicious, it produces output the client did not anticipate. The trigger is therefore the normal, documented kubectl cp operation itself — no special victim action beyond the copy is required to activate the flaw.

3) Payload / execution at the vulnerability-class level. The malicious tar emits crafted archive entries containing path traversal sequences, so that when the Windows client extracts the archive, file members are written to locations outside the intended destination directory. Consistent with CWE-22, the traversal segments in member names redirect the write target. The description also notes the binary "can execute arbitrary code," i.e., the malicious archiver may run its own code container-side as part of producing the corrupted output. No specific file names, path strings, or code constructs are provided in the advisory, so none are asserted here.

4) Post-exploitation impact. The attacker gains the ability to write files to arbitrary paths on the victim's local Windows machine, "limited only by the system permissions of the local user." This is a local file-write primitive whose destructive potential depends on what the overwritten or newly created paths control. The CVSS subscores reflect this: Integrity impact is High (I:H) and Scope is Changed (S:C) — the vulnerable component (the client extraction) affects resources beyond its original security scope (the broader local filesystem). Confidentiality impact is Low (C:L) and Availability impact is None (A:N). The user-interaction requirement (UI:R) is reflected in the need for the victim to run kubectl cp, and the attack requires network adjacency (AV:A) with high attacker privileges (PR:H).

Attacker prerequisites summary: control over container contents (specifically the tar binary the container provides), a Windows victim running kubectl cp against that container, network adjacency, and high privilege positioning. Because these are non-trivial preconditions, the CVSS base score is Medium (6.5) rather than High.

Impact Assessment

Business impact. In environments where engineers routinely pull files out of containers via kubectl cp — a common developer and diagnostic workflow — a malicious or compromised container image can escalate that routine operation into arbitrary file-write on the engineer's Windows workstation. Depending on the paths written and local user privileges, this could overwrite configuration, drop files into startup or user-profile locations, or corrupt tooling. Because writes are bounded by the local user's permissions, non-privileged users are constrained, but users with elevated rights (or where sensitive paths are user-writable) face greater exposure.

Affected systems. Only kubectl clients running on the Windows platform are affected, per the advisory. Linux and macOS clients are explicitly out of scope. Any Windows host that runs kubectl cp against containers whose tar binary is not trusted is a potential target.

Blast radius. The blast radius is scoped to the individual Windows client machine on which the copy is performed — the vulnerability does not, per the description, compromise the cluster control plane or other tenants. However, the Scope:Changed (S:C) rating underscores that the impact crosses from the archive-extraction component into the wider local filesystem.

CVSS interpretation. AV:A (adjacency required), AC:L (no special conditions beyond the described flow), PR:H (attacker needs high privileges in the location hosting the malicious container), UI:R (victim must invoke kubectl cp), S:C (impact beyond the vulnerable component), C:L / I:H / A:N (low confidentiality, high integrity, no availability impact) → Base 6.5 Medium. CISA KEV: NO. EPSS: not yet scored by FIRST.org (no value fabricated).

Detection Guidance

Detection here focuses on the observable behavior of kubectl/tar on Windows endpoints and on archive-transfer anomalies, since no network signature for a specific exploit exists. Rules below are written to the vulnerability class and should be tuned to your environment.

Sigma Rule

title: Suspicious kubectl cp Archive Extraction Behavior on Windows
id: 3f6b1c2e-1944-4a7b-9c21-0d5e7a8b1944
status: experimental
description: Detects potential CVE-2026-19444 abuse where kubectl on Windows extracts archives during kubectl cp, especially with path traversal indicators in file writes outside the destination directory.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19444
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1195.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\kubectl.exe'
  selection_cmd:
    CommandLine|contains:
      - ' cp '
      - 'kubectl cp'
  selection_tar:
    CommandLine|contains:
      - 'tar'
      - ' -c '
  condition: selection_img and selection_cmd
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate administrative use of kubectl cp on Windows
level: medium

YARA Rule

rule CVE_2026_19444_Tar_Traversal_Archive
{
    meta:
        description = "Detects tar archives containing path traversal sequences consistent with CVE-2026-19444 (kubectl cp on Windows)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19444"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $trav1 = "../../"
        $trav2 = "..\\..\\"
        $trav3 = "../.."
        $trav4 = "..\\..\\"
        $tarhdr = "ustar"

    condition:
        $tarhdr and any of ($trav*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-19444 kubectl cp tar archive with path traversal member names"; flow:established,to_client; content:"ustar"; content:"../"; distance:0; within:512; sid:20261944; rev:1; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19444; metadata:created_at 2026_01_01, cve CVE-2026-19444;)

Note: Kubernetes API traffic is typically TLS-encrypted on port 6443; this rule applies only where API traffic is decrypted (e.g., inline TLS inspection) or where archives traverse a cleartext channel. Adjust ports and content offsets to your environment.

Elastic Detection

process where event.type == "start" and
  process.name : "kubectl.exe" and
  process.command_line : "* cp *"

Splunk SPL Query

index=winlogs sourcetype=WinEventLog:Security EventCode=4688
| where match(New_Process_Name, "(?i)kubectl\\.exe$")
| where match(Process_Command_Line, "(?i)kubectl\s+cp")
| stats count min(_time) as firstTime max(_time) as lastTime
    values(Process_Command_Line) as cmd
    by ComputerName, Account_Name, New_Process_Name
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="windows,kubectl,cve-2026-19444,">
  <rule id="20261944" level="7">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">kubectl.exe</field>
    <field name="win.eventdata.commandLine">kubectl cp</field>
    <description>CVE-2026-19444: kubectl cp executed on Windows - potential tar path traversal extraction</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no workarounds, and no affected-version range are documented in the tracked sources. There is no CISA KEV listing and no public PoC. The following measures are defensive and must be verified against an eventual official Kubernetes advisory.

1) Immediate mitigations

• Restrict or forbid kubectl cp from untrusted or untrusted-image containers on Windows workstations. Prefer alternative retrieval methods (e.g., cluster-side copy to a trusted location, or copying to a controlled intermediate host) until a fix is available.
• Never run kubectl cp against containers whose images or contents are not trusted. Because the malicious component is the container-side tar, trust in the image is the controlling factor.
• Enforce least privilege for local Windows user accounts so that the file-write primitive is bounded to low-value paths. Avoid running kubectl as an elevated user when practical.
• Segment and monitor the network path to the Kubernetes API server, given the AV:A (adjacency) precondition.
• Adopt a policy of pinning and verifying container images, since the attack depends on attacker-controlled container contents.

2) Patch / upgrade steps

• No patch is currently available per tracked sources. Monitor the official Kubernetes security advisories and CVE channels for a kubectl release that addresses this issue.
• When a fix is released, upgrade the kubectl client binary on all affected Windows hosts and verify the version. Given the issue is client-side and Windows-specific, patching the client is the primary remediation path.
• Do not rely on unverified third-party "fixes"; track only the canonical vendor advisory.

3) Long-term hardening

• Treat container images and their tooling (including tar) as untrusted inputs to client-side tooling; design workflows that do not implicitly trust remote-produced archives.
• Adopt archive-extraction hardening practices for any tooling that unpacks remote archives: confine writes to the destination directory and reject members with absolute or ..-containing paths.
• Maintain process-execution telemetry (the Sigma/Splunk/Wazuh detections above) on developer Windows endpoints to surface anomalous kubectl cp activity.
• Keep kubectl and the Kubernetes toolchain on a regular, tracked update cadence and subscribe to Kubernetes security announcements.

References

• NVD — CVE-2026-19444: https://nvd.nist.gov/vuln/detail/CVE-2026-19444
• Kubernetes official security advisories (monitor for the corresponding advisory): https://kubernetes.io/docs/reference/issues-security/official-cve-feed/
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Kubernetes documentation — kubectl cp reference: https://kubernetes.io/docs/reference/kubectl/generated/kubectl_cp/
• MITRE ATT&CK — T1195.002 Supply Chain Compromise: Compromise Software Supply Chain: https://attack.mitre.org/techniques/T1195/002/

Exploit-in-the-wild / threat actor note: No public exploit code, no PoC, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-19444 in the tracked sources. There is no evidence of active exploitation or attributable threat-actor campaigns at the time of writing. No EPSS score has been published by FIRST.org.