CVE-2026-15687: Path traversal via non-tar copyDirectoryFromPod

[cjcullen]

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations.

This issue has been rated Low (2.7) (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N), and assigned CVE-2026-15687.

Am I vulnerable?

If you use the copyDirectoryFromPod method in the Kubernetes Java Client with enableTarCompressing set to false (which is the recommended path for distroless containers that lack tar) to copy files from untrusted pods, you may be vulnerable.

Affected Versions

• Kubernetes Java Client >= 10.0.0, < 25.0.1
• Kubernetes Java Client == 26.0.0

How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by ensuring you only copy files from trusted pods, or by ensuring tar is available in the container to use the secure tar-based copy path.

Fixed Versions

• Kubernetes Java Client >= 27.0.0
• Kubernetes Java Client >= 26.0.1
• Kubernetes Java Client >= 25.0.1

To upgrade, specify a fixed version in your java package manager.

Detection

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

Additional Details

See the GitHub issue for more details: #4861

Acknowledgements

This vulnerability was reported by Ibrahim el zein and Hasan Sheet through our bug bounty.

/area security
/kind bug
/committee security-response
/label official-cve-feed

[brendandburns]

Closing this issue since it is fixed at HEAD and also in versions 25.0.1, 26.0.1 and 27.0.0 as described above.