Read the docs
TI-2026-44064 Aliases CVE-2026-61459GHSA-wmg3-h8mf-wgvr

MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

Priority HIGH 81CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.

Summary

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02362 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed mcp-server-kubernetes (Flux159): 3.9.0mcp-server-kubernetes (npm): 3.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Flux159mcp-server-kubernetesbefore 3.9.03.9.0Patch availableCNA
—mcp-server-kubernetes (npm)before 3.9.03.9.0Patch availableGHSA-wmg3-h8mf-wgvr
  • mcp-server-kubernetes VendorFlux159 Affected before 3.9.0 Fixed in 3.9.0 Patch available CNA
  • mcp-server-kubernetes (npm) Vendor— Affected before 3.9.0 Fixed in 3.9.0 Patch available GHSA-wmg3-h8mf-wgvr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:*before 3.9.0VulnerableFlux159
  • cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:* Versions before 3.9.0 Vulnerable ·Flux159

Remediation

  • Fix · CNA mcp-server-kubernetes (Flux159) Fixed in 3.9.0
  • Fix · GHSA-wmg3-h8mf-wgvr mcp-server-kubernetes (npm) Fixed in 3.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61459
  2. 2026-10-03 Alias added: GHSA-wmg3-h8mf-wgvr
  3. 2026-10-28 Fix available: npm/[email protected] · GHSA-wmg3-h8mf-wgvr

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2025-40841 mcp-server-kubernetes potential security issue in exec_in_pod tool CVSS 3.1HIGH 8.8
  • TI-2026-28763 MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences