CVE-2026-15687

{
  "id": "CVE-2026-15687",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-23T19:16:53.390",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema de seguridad en la biblioteca cliente Java de Kubernetes donde un pod comprometido podría crear nuevos archivos en ubicaciones arbitrarias en la máquina cliente ejecutando operaciones de copia a través de copyDirectoryFromPod sin tar cuando enableTarCompressing es falso."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Kubernetes",
          "product": "kubernetes-client/java",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/kubernetes-client/java",
          "versions": [
            {
              "version": "10.0.0",
              "lessThan": "25.0.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "26.0.0",
              "status": "affected"
            },
            {
              "version": "25.0.1",
              "status": "unaffected"
            },
            {
              "version": "26.0.1",
              "status": "unaffected"
            },
            {
              "version": "27.0.0",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 2.4,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T19:03:05.902593Z",
          "id": "CVE-2026-15687",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kubernetes-client/java/issues/4861",
      "source": "[email protected]"
    }
  ]
}