[Security Advisory - Kubernetes Java Client] CVE-2026-15687: Path traversal via non-tar copyDirectoryFromPod

18 views
Skip to first unread message

CJ Cullen

unread,
Jul 22, 2026, 6:11:48 PM (3 days ago) Jul 22
to kubernete...@googlegroups.com, d...@kubernetes.io, kubernetes-sec...@googlegroups.com, kubernetes-se...@googlegroups.com, distributo...@kubernetes.io

Hello Kubernetes Community,


A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations.


This issue has been rated Low (2.7) (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N), and assigned CVE-2026-15687.

Am I vulnerable?

If you use the copyDirectoryFromPod method in the Kubernetes Java Client with enableTarCompressing set to false (which is the recommended path for distroless containers that lack tar) to copy files from untrusted pods, you may be vulnerable.

Affected Versions

  • Kubernetes Java Client >= 10.0.0, < 25.0.1

  • Kubernetes Java Client == 26.0.0

How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by ensuring you only copy files from trusted pods, or by ensuring tar is available in the container to use the secure tar-based copy path.

Fixed Versions

  • Kubernetes Java Client >= 27.0.0

  • Kubernetes Java Client >= 26.0.1

  • Kubernetes Java Client >= 25.0.1

To upgrade, specify a fixed version in your java package manager.

Detection

If you find evidence that this vulnerability has been exploited, please contact secu...@kubernetes.io

Additional Details

See the GitHub issue for more details: [Link to public GitHub issue]

Acknowledgements

This vulnerability was reported by Ibrahim el zein and Hasan Sheet through our bug bounty.


Thank You,


CJ Cullen on behalf of the Kubernetes Security Response Committee



Reply all
Reply to author
Forward
0 new messages