All vulnerabilities
CVE-2026-61459GHSA-wmg3-h8mf-wgvrPYSEC-2026-3685

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

Flux159 mcp-server-kubernetesnpmContainers & cloud
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationPublic exploit codeRemote exploit, 11 Aug 2026. Not in the KEV catalogExploit-DB
Exploit odds (EPSS)2.36%Chance of exploitation activity in the next 30 days, higher than 83% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in3.9.0Fixed versionGitHub
Published10 Jul 2026Updated 28 Oct 2026CVE List

What fixes it

  • 3.9.0mcp-server-kubernetes, npmGitHubnpm install mcp-server-kubernetes@3.9.0
  • 3.9.0mcp-server-kubernetesCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 10 Jul 2026, 18:34 UTCPublishedCVE List
  2. 11 Aug 2026Exploit code publicExploit-DB

Public exploit code and templates 1

  • Remote exploitmcp-server-kubernetes 3.8.x - Argument Injection 11 Aug 2026Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

Text from CVE List

Affected versions 3

  • mcp-server-kubernetes, npm< 3.9.0GitHub
  • mcp-server-kubernetesaffected: all versions before 3.9.0CVE List
  • mcp-server-kubernetes, npmfrom first release, fixed in 3.9.0OSV

References 7