« Volver al listado

CVE-2026-15687

Estado: Pendiente de análisisBaja (2.4)—

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kubernetes — Java Client LibraryAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-15687",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15687",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-23T19:03:05.902593Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "jordan@liggitt.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 2.4,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "jordan@liggitt.net",
      "affectedData": [
        {
          "repo": "https://github.com/kubernetes-client/java",
          "vendor": "Kubernetes",
          "product": "kubernetes-client/java",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "25.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "26.0.0"
            },
            {
              "status": "unaffected",
              "version": "25.0.1"
            },
            {
              "status": "unaffected",
              "version": "26.0.1"
            },
            {
              "status": "unaffected",
              "version": "27.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-23T19:16:53.390",
  "references": [
    {
      "url": "https://github.com/kubernetes-client/java/issues/4861",
      "source": "jordan@liggitt.net"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "jordan@liggitt.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false."
    }
  ],
  "lastModified": "2026-07-23T20:17:07.627",
  "sourceIdentifier": "jordan@liggitt.net"
}