CVE-2026-15687
LOWKubernetes Java Client copyDirectoryFromPod - Path Traversal
Title source: manualDescription
A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.
References (1)
Core 1
Core References
Issue Tracking issue-tracking
https://github.com/kubernetes-client/java/issues/4861
Scores
CVSS v3
2.4
EPSS
0.0024
EPSS Percentile
14.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (5)
Kubernetes/kubernetes-client/java
10.0.0 - 25.0.1
Kubernetes/kubernetes-client/java
25.0.1
Kubernetes/kubernetes-client/java
26.0.0
Kubernetes/kubernetes-client/java
26.0.1
Kubernetes/kubernetes-client/java
27.0.0
Published
Jul 23, 2026
Tracked Since
Jul 24, 2026