CVE-2026-19444: HOW COPYING IN KUBECTL BREAKS TRUST

Summary from the TLDR InfoSec newsletter

A malicious container can write files anywhere a Windows user's account can reach, including the Startup folder, when that user runs kubectl cp against it (CVE-2026-19444, CVSS 6.5). kubectl cp unpacks the output of whatever tar binary the container ships, and the entry-path check added after three 2019 CVEs never accounted for Windows path separators. Windows clients need kubectl v1.36.5, v1.35.9, or v1.34.12, since the flaw is in client-side extraction and the cluster version does not matter.