All vulnerabilities
CVE-2025-65719GHSA-94gr-w3q5-rfqrPYSEC-2026-371

kubectl-mcp-server: Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

n/a kubectl-mcp-servernpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.58%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in1.2.0Fixed versionGitHub
Published12 May 2026Updated 27 Oct 2026CVE List

What fixes it

  • 1.2.0kubectl-mcp-server, npmGitHubnpm install kubectl-mcp-server@1.2.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.

Text from CVE List

Affected versions 5

  • kubectl-mcp-server, npm< 1.2.0GitHub
  • kubectl-mcp-server, pip< 1.2.0GitHub
  • n/aaffected: n/aCVE List
  • kubectl-mcp-server, npmfrom first release, fixed in 1.2.0OSV
  • kubectl-mcp-server, PyPIfrom first release, fixed in 1.2.0OSV

References 8