Description
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
Published: 2026-07-10
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MCP Server Kubernetes before version 3.9.0 has an argument‑injection flaw in its structured tools (kubectl_get, kubectl_describe, kubectl_delete). By crafting the resourceType and name parameters with leading dashes, an attacker can bypass the internal assertNoDangerousFlags check and inject a --server flag. The injected flag redirects the kubectl command to an attacker‑controlled API server, causing the operator’s bearer token to be transmitted externally and enabling full compromise of the Kubernetes cluster.

Affected Systems

Flux159 MCP Server Kubernetes versions released prior to 3.9.0 are affected. The product is a Node.js‑based application that exposes the kubectl_* structured tools without proper validation.

Risk and Exploitability

The CVSS score of 9.3 marks the flaw as critical. Its EPSS score of less than 1 % indicates a low current exploitation probability, and it is not listed in the CISA KEV catalog. However, because the vulnerability can be exploited remotely by invoking the vulnerable tools, the risk remains high if the service is exposed to untrusted networks. An attacker can redirect commands, exfiltrate authentication tokens, and ultimately gain full cluster control.

Generated by OpenCVE AI on July 29, 2026 at 10:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to MCP Server Kubernetes version 3.9.0 or later
  • If an upgrade cannot be performed immediately, disable or restrict external access to the kubectl_* structured tools until the patch is applied
  • Implement network perimeter controls that block unexpected --server flag usage and enforce strict token validation to prevent accidental token leakage

Generated by OpenCVE AI on July 29, 2026 at 10:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Suyogs
Suyogs mcp-server-kubernetes
CPEs cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:*
Vendors & Products Suyogs
Suyogs mcp-server-kubernetes

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Flux159
Flux159 mcp-server-kubernetes
Vendors & Products Flux159
Flux159 mcp-server-kubernetes

Fri, 10 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Description MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
Title MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
Weaknesses CWE-88
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Flux159 Mcp-server-kubernetes
Suyogs Mcp-server-kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-14T22:03:38.209Z

Reserved: 2026-07-09T14:07:55.624Z

Link: CVE-2026-61459

cve-icon Vulnrichment

Updated: 2026-07-13T14:55:08.326Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T10:30:05Z

Weaknesses
  • CWE-88

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')