CVE-2026-61459

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-61459
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a Patch
https://github.com/Flux159/mcp-server-kubernetes/issues/328 Issue Tracking Exploit Mitigation Vendor Advisory
https://github.com/Flux159/mcp-server-kubernetes/pull/329 Issue Tracking Patch
https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0 Release Notes
https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:*
History

17 Jul 2026, 12:27

Type Values Removed Values Added
First Time Suyogs mcp-server-kubernetes
Suyogs
CPE cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:*
References () https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a - () https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a - Patch
References () https://github.com/Flux159/mcp-server-kubernetes/issues/328 - () https://github.com/Flux159/mcp-server-kubernetes/issues/328 - Issue Tracking, Exploit, Mitigation, Vendor Advisory
References () https://github.com/Flux159/mcp-server-kubernetes/pull/329 - () https://github.com/Flux159/mcp-server-kubernetes/pull/329 - Issue Tracking, Patch
References () https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0 - () https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0 - Release Notes
References () https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools - () https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools - Third Party Advisory

10 Jul 2026, 19:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-10 19:17

Updated : 2026-07-17 12:27

NVD link : CVE-2026-61459

Mitre link : CVE-2026-61459

CVE.ORG link : CVE-2026-61459

JSON object : View

Products Affected

suyogs

  • mcp-server-kubernetes
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')