CVE-2019-1002101: kubectl cp path traversal

Security readout for executives and security teams

This is a client-side kubectl risk, not a Kubernetes control-plane takeover. A malicious or compromised container can abuse kubectl cp when an operator copies files from it, causing files to be written outside the intended destination on the operator’s machine. Exposure is most likely on administrator workstations, jump hosts, and CI systems using vulnerable kubectl versions 1.1 through 1.13 and running kubectl cp against untrusted, compromised, or attacker-controlled containers. Treat this as a targeted operator-workstation risk. It is not broadly wormable, but compromised developer or administrator machines can lead to credential theft, operational disruption, and further cloud or cluster compromise. Mitigation focus: Upgrade kubectl to v1.11.9, v1.12.7, v1.13.5, v1.14.0, or later.; Prioritize kubectl upgrades on admin laptops, jump hosts, build agents, and automation runners.; Avoid kubectl cp from untrusted, compromised, or externally supplied container images..

Prepared

May 24, 2026, 20:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.