CVE-2026-15687 | A security issue was discovered in the Kubernetes Java clien… | CVSS 2.7 LOW

Description

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

Metadata

CVE ID: CVE-2026-15687
State: PUBLISHED
Assigner: kubernetes
Reserved: 2026-07-13 23:31 UTC
Published: 2026-07-23 18:43 UTC
Last updated: 2026-07-23 19:03 UTC
Primary CWE: CWE-22
CWE-22: Improper Limitation of a Pathname to a Restricted Di…
Vendor / Product: Kubernetes / kubernetes-client/java
Sources: cve.org · NVD

Severity & Metrics

2.7 LOW CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Kubernetes	kubernetes-client/java	—	10.0.0 < 25.0.1, 26.0.0, 25.0.1, 26.0.1 …

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (1)

Score	Severity	Version	Source	Vector
2.7	LOW	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

References (1)

https://github.com/kubernetes-client/java/issues/4861