Kubernetes (Vendor): news timeline & CVEs

[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes

Kubernetes assigned CVE-2026-19444 to a Windows kubectl cp path traversal that allows arbitrary file writes.

Vyom Yadav notified the Kubernetes community on oss-security about CVE-2026-19444. The flaw is a path traversal in kubectl cp on Windows that allows arbitrary file writes. It has a CVSS 3.1 score of 6.5. The published message is truncated before the full affected-version and remediation guidance.

oss-securitySep 28, 11:44 UTC · 1d agoVulnerability CVE-2026-194446· 5 reads

Secure VMs for Kubernetes: Hardening Kata containers

A developer used AI agent Astra to cut ~60% of Kata Containers code, releasing a minimal-attack-surface fork for Kubernetes on Firecracker VMs.

The author used OpenAI's Codex CLI running the Astra agent to delete about 60% of Kata Containers code, leaving 13.5k SLOC for the host runtime and 8.1k SLOC for the agent, while preserving x86_64 Kubernetes workload support in Firecracker VMs. The goal was to shrink the attack surface of host-facing code that parses guest RPC data, since Kata opens host-guest channels that base Firecracker does not. Changes were validated on a homelab cluster running untrusted Kubernetes pods; the fork is unaudited and not production-tested. The post cites Artem Dinaburg's August 2026 experiments in which GPT-5.6 Cyber escaped qemu to the Debian host three times as motivation.

Lobsters · securitySep 19, 17:11 UTC · 10d agoResearch

Kubernetes

Timeline2 articles

Related CVEsby mentions

Appears with

[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes

Secure VMs for Kubernetes: Hardening Kata containers