Threat Intelligence Database

CVE-2026-61459 is a critical argument injection vulnerability in Flux159 mcp-server-kubernetes versions before 3.9.0. It affects structured tools such as kubectl_get, kubectl_describe, and kubectl_delete by allowing attackers to bypass security checks via crafted resourceType and name parameters with leading dashes. This enables injection of the --server flag, redirecting kubectl commands to an attacker-controlled API server, exposing the operator's bearer token and potentially leading to full cluster compromise.

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application's log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer <token> header from the operator's kubeconfig to the attacker's endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator's service account. This issue has been patched in version 3.7.0.

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.

CVE-2026-39884 is an argument injection vulnerability in the Flux159 mcp-server-kubernetes product versions prior to 3.5.0. The vulnerability exists in the port_forward tool, where user-controlled input is concatenated into a kubectl command string and split on spaces before execution, allowing injection of arbitrary kubectl flags. This can lead to exposure of internal Kubernetes services, cross-namespace access, and indirect exploitation via prompt injection against AI agents connected to the MCP server. The issue has been fixed in version 3.5.0.

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-66404#cwe-77

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-53355#cwe-77