What is the CVSS score of CVE-2026-15687?

CVE-2026-15687 has a CVSS 3.0 base score of 2.4 (Low). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-15687?

Yes, a patch is available for CVE-2026-15687. Update the affected software to the latest version immediately.

Kubernetes Java Client CVE-2026-15687

EUVD-2026-48363 LOW

Path Traversal (CWE-22)

2026-07-23 kubernetes

GHSA-95wq-2cx3-rp73

Java Path Traversal Kubernetes Kubernetes Client Java

2.4

CVSS 3.0 · Vendor: kubernetes

Severity by source

Vendor (kubernetes) PRIMARY

2.4 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

2.4 LOW

Network vector as compromised pod is remote; PR:H because the operator executing the copy must hold cluster permissions; UI:R for active copy invocation; I:L for arbitrary file creation without overwrite.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (kubernetes).

CVSS VectorVendor: kubernetes

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 23, 2026 - 20:03 EUVD

CVSS changed

Jul 23, 2026 - 19:23 NVD

2.7 (LOW) 2.4 (LOW)

Analysis Generated

Jul 23, 2026 - 19:22 vuln.today

DescriptionCVE.org

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

AnalysisAI

Path traversal in the Kubernetes Java client library's copyDirectoryFromPod function allows a compromised pod to write files to arbitrary locations on the local machine of a high-privileged operator performing copy operations. The vulnerability is only reachable when enableTarCompressing is set to false, and requires both an attacker-controlled pod and an operator actively running a copy command. With a CVSS score of 2.7 (PR:H, UI:R), no public exploit, and no CISA KEV listing, this is a narrow but credible lateral-movement vector in DevOps and CI/CD operator workflows rather than a broadly exploitable flaw.

Technical ContextAI

The vulnerability resides in the official Kubernetes Java client library (cpe:2.3:a:kubernetes:kubernetes-client/java:*:*:*:*:*:*:*:*), the Java SDK used to interact programmatically with Kubernetes cluster APIs. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) is the root cause: when copyDirectoryFromPod is invoked with enableTarCompressing=false, file paths returned by the source pod are not sufficiently sanitized before being used to construct destination paths on the local client filesystem. This allows a malicious pod to inject traversal sequences (e.g., ../../etc/cron.d/backdoor) into filenames, escaping the intended destination directory. The tar-based code path is not affected; only the non-tar branch exhibits this behavior.

RemediationAI

The immediate workaround is to avoid invoking copyDirectoryFromPod with enableTarCompressing=false - enabling tar compression (omit the flag or set it to true) eliminates the vulnerable non-tar code path with minimal operational impact. Operators should also restrict pod copy operations to fully trusted pods and avoid running copy commands against pods from untrusted namespaces or sources. No confirmed patched release version is available in the current data; monitor the upstream issue at https://github.com/kubernetes-client/java/issues/4861 for a tagged fix release. As a defense-in-depth measure, restrict Kubernetes RBAC permissions for exec and copy operations to the smallest set of operators or service accounts that require them, reducing the population of accounts that could trigger the vulnerable code path.