The vulnerability arises from improper neutralization of argument delimiters (CWE-88) in the port_forward tool of mcp-server-kubernetes. Specifically, user input fields such as namespace, resourceType, resourceName, localPort, and targetPort are concatenated into a command string and split on spaces before being passed to spawn(), unlike other tools that use array-based argument passing with execFileSync(). This flawed handling allows attackers to inject additional kubectl flags, enabling unauthorized exposure of internal services, cross-namespace targeting, and potential prompt injection attacks on AI agents. The vulnerability affects versions 3.4.0 and earlier and was addressed in version 3.5.0.

Successful exploitation can lead to unauthorized exposure of internal Kubernetes services to the network by injecting flags like --address=0.0.0.0, unauthorized cross-namespace access by injecting additional -n flags, and indirect exploitation through prompt injection against AI agents connected to the MCP server. The CVSS v3.1 score is 8.3 (high), indicating high confidentiality and integrity impact with low attack complexity and no user interaction required.

A fix for this vulnerability is available in mcp-server-kubernetes version 3.5.0. Users should upgrade to version 3.5.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fix in 3.5.0, so users should refer to the vendor's official release notes or advisories for confirmation and detailed upgrade instructions.