OESA-2026-4460

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4460

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4460.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4460

Upstream

CVE-2026-19444

Published

2026-10-22T14:35:24Z

Modified

2026-10-22T14:45:04Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N CVSS Calculator

Summary

kubernetes security update

Details

Container cluster management.

Security Fix(es):

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary in the container is malicious, it can execute arbitrary code and emit unexpected output, allowing an attacker who controls container contents to write files to arbitrary paths on the user's local machine when kubectl cp is invoked, limited only by the system permissions of the local user. This issue only affects kubectl clients running on Windows.(CVE-2026-19444)

Database specific

{
    "severity":  "Medium"
}

References

Affected packages

openEuler:22.03-LTS-SP4 / kubernetes

Package

Name: kubernetes
Purl: pkg:rpm/openEuler/kubernetes&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.20.2-33.oe2203sp4

Ecosystem specific

{
    "aarch64":  [
        "kubernetes-1.20.2-33.oe2203sp4.aarch64.rpm",
        "kubernetes-client-1.20.2-33.oe2203sp4.aarch64.rpm",
        "kubernetes-help-1.20.2-33.oe2203sp4.aarch64.rpm",
        "kubernetes-kubeadm-1.20.2-33.oe2203sp4.aarch64.rpm",
        "kubernetes-kubelet-1.20.2-33.oe2203sp4.aarch64.rpm",
        "kubernetes-master-1.20.2-33.oe2203sp4.aarch64.rpm",
        "kubernetes-node-1.20.2-33.oe2203sp4.aarch64.rpm"
    ],
    "src":  [
        "kubernetes-1.20.2-33.oe2203sp4.src.rpm"
    ],
    "x86_64":  [
        "kubernetes-1.20.2-33.oe2203sp4.x86_64.rpm",
        "kubernetes-client-1.20.2-33.oe2203sp4.x86_64.rpm",
        "kubernetes-help-1.20.2-33.oe2203sp4.x86_64.rpm",
        "kubernetes-kubeadm-1.20.2-33.oe2203sp4.x86_64.rpm",
        "kubernetes-kubelet-1.20.2-33.oe2203sp4.x86_64.rpm",
        "kubernetes-master-1.20.2-33.oe2203sp4.x86_64.rpm",
        "kubernetes-node-1.20.2-33.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4460.json"