Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-61459

CVE-2026-61459 describes an argument injection flaw (CWE-88) in mcp-server-kubernetes before 3.9.0, where the structured tools kubectl_get, kubectl_describe, and kubectl_delete fail to block leading-dash resourceType/name parameters, letting an attacker bypass the assertNoDangerousFlags check and inject a --server flag. This redirects kubectl calls to an attacker-controlled API server, leaking the operator's bearer token and enabling full Kubernetes cluster compromise. Fixed in v3.9.0; details corroborated by a VulnCheck advisory and the upstream GitHub commit/PR.

TL;DR Argument-injection bug in the mcp-server-kubernetes MCP server lets attackers hijack kubectl's --server flag via structured tool parameters, exfiltrating cluster bearer tokens.
Open original ↗
Document

What it is

CVE-2026-61459 in mcp-server-kubernetes (before 3.9.0) carries a CVSS 4.0 base score of 9.3 (CRITICAL), published 2026-07-10 and now in "Analyzed" status. The existing summary covers the mechanism (leading-dash args bypassing assertNoDangerousFlags, --server injection, bearer-token exfiltration); what the NVD page adds is the severity and exploitability profile that governs how urgently to act.

Preconditions / Affected

The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H. Read for prioritization:

  • AV:N / AC:L — network-reachable, low attack complexity.
  • PR:N / UI:N — no privileges and no user interaction required; an attacker who can reach the MCP tool interface and supply resourceType/name parameters needs nothing else.
  • VC:H / VI:H / VA:H — high confidentiality, integrity, and availability impact (consistent with token theft plus full cluster control).

The affected product is listed as suyogs mcp-server-kubernetes.

What to do

Upgrade to 3.9.0, which contains the fix. The page's references pin the exact provenance if you need to verify or backport:

  • Fix commit: d7890f50a4567bf5d9842541ba6f41e180227f9a
  • Issue: Flux159/mcp-server-kubernetes#328
  • PR: Flux159/mcp-server-kubernetes#329
  • Release: tag 3.9.0
  • VulnCheck advisory: mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools

Given PR:N/UI:N and the token-exfiltration impact, treat any pre-3.9.0 deployment exposed to untrusted tool input as requiring immediate patching.

Organisations named here

  • CWE-88

CVEs named here

  • CVE-2026-61459

Technologies named here

  • mcp-server-kubernetes
  • Model Context Protocol
  • Kubernetes

Techniques named here

  • Argument injection via structured tool parameters

Related in AI Security