TI-2025-40841 Aliases CVE-2025-66404 GHSA-wvxp-jp4w-w8wg

mcp-server-kubernetes potential security issue in exec_in_pod tool

HIGH 73CWE-77Published 2025-12-03 · Updated 2025-12-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0148 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mcp-server-kubernetes (Flux159): 2.9.8mcp-server-kubernetes (npm): 2.9.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Flux159	mcp-server-kubernetes	before 2.9.8	2.9.8	Patch available	CNA
—	mcp-server-kubernetes (npm)	before 2.9.8	2.9.8	Patch available	GHSA-wvxp-jp4w-w8wg

mcp-server-kubernetes VendorFlux159 Affected before 2.9.8 Fixed in 2.9.8 Patch available CNA
mcp-server-kubernetes (npm) Vendor— Affected before 2.9.8 Fixed in 2.9.8 Patch available GHSA-wvxp-jp4w-w8wg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suyogs:mcp-server-kubernetes::::::node.js::*	before 2.9.8	Vulnerable	Flux159

cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:* Versions before 2.9.8 Vulnerable ·Flux159

Remediation

Fix · CNA mcp-server-kubernetes (Flux159) Fixed in 2.9.8
Fix · GHSA-wvxp-jp4w-w8wg mcp-server-kubernetes (npm) Fixed in 2.9.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-66404
2026-10-03 Alias added: GHSA-wvxp-jp4w-w8wg

References

Other 2

TI-2026-44064 MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools CVSS 4.0CRITICAL 9.3
TI-2026-28763 MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences