{"id":"CVE-2025-65719","kind":"vulnerability","aliases":["CVE-2025-65719","GHSA-94gr-w3q5-rfqr"],"related":[],"title":"Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page","description":"An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.","summary":"The kubectl-mcp-server MCP server, published on npm and PyPI, can be made to execute arbitrary code on a victim's system when that user opens a crafted HTML page. The sources describe the attacker gaining code execution with the victim's privileges, which can include access to their Kubernetes credentials.","severity":"critical","cvss":9.8,"epss":0.00578,"exploited":false,"exploited_at":null,"products":[{"name":"kubectl-mcp-server","fixed":["1.2.0"],"affected":"< 1.2.0","ecosystem":"npm"},{"name":"kubectl-mcp-server","fixed":["1.2.0"],"affected":"< 1.2.0","ecosystem":"pypi"}],"ecosystems":["npm","pypi"],"tags":["ai-tooling","cwe-94","developer-workstation","kubernetes","mcp","npm","python"],"not_affected_if":["fixed-version-1.2.0-or-later"],"how_to_check":"- Run `npm ls kubectl-mcp-server` or `pip show kubectl-mcp-server` and compare the version to `1.2.0`\n- Check whether the MCP server is running on a developer workstation where a browser is also in use","fix":"- Upgrade the npm package `kubectl-mcp-server` to `1.2.0` or later\n- Upgrade the PyPI package `kubectl-mcp-server` to `1.2.0` or later","status":"open","published_at":"2026-05-12T17:16:15+00:00","first_seen_at":"2026-10-27T17:32:35+00:00","triaged_at":"2026-10-27T17:35:06+00:00","updated_at":"2026-10-27T17:35:06+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-27T17:35:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the npm package `kubectl-mcp-server` to `1.2.0` or later\n- Upgrade the PyPI package `kubectl-mcp-server` to `1.2.0` or later","reach":"unknown","title":"Kubectl MCP Server: crafted web page runs code on the user's machine","impact":"high","summary":"The kubectl-mcp-server MCP server, published on npm and PyPI, can be made to execute arbitrary code on a victim's system when that user opens a crafted HTML page. The sources describe the attacker gaining code execution with the victim's privileges, which can include access to their Kubernetes credentials.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","kubernetes","npm","python","developer-workstation"],"confidence":0.7,"needs_auth":"unknown","worst_case":"code runs on the victim's machine with their privileges","analyst_note":"Check the GHSA-94gr-w3q5-rfqr advisory for the exact reachable endpoint and whether the server must listen on a network interface.","how_to_check":"- Run `npm ls kubectl-mcp-server` or `pip show kubectl-mcp-server` and compare the version to `1.2.0`\n- Check whether the MCP server is running on a developer workstation where a browser is also in use","needs_analyst":true,"not_affected_if":["fixed-version-1.2.0-or-later"],"who_is_affected":"Teams running kubectl-mcp-server before 1.2.0 from npm or PyPI, most likely on a developer machine where the server is reachable by a browser the user also uses. The sources do not describe the exact configuration needed to reach the flaw, so a host that does not run the server can skip it. Teams already on 1.2.0 or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000666,"input_tokens":3410,"output_tokens":649,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':19A,27A '-65719':20A,28A '-94':41B '94gr':23A 'access':97B 'ai':38B 'ai-tool':37B 'allow':111C 'arbitrari':8A,66B,115C 'attack':85B,112C 'code':9A,67B,87B,116C 'craft':15A,78B,126C 'credenti':101B 'cve':18A,26A 'cwe':40B 'describ':83B 'develop':43B 'developer-workst':42B 'execut':10A,65B,88B,114C 'gain':86B 'ghsa':22A 'ghsa-94gr-w3q5-rfqr':21A 'html':16A,79B,127C 'includ':96B 'interact':13A,123C 'issu':103C 'kubectl':3A,30A,34A,51B,107C 'kubectl-mcp-serv':50B 'kubectl-mcp-server':29A,33A 'kubernet':45B,100B 'made':63B 'mcp':4A,31A,35A,46B,52B,54B,108C 'npm':47B,58B 'open':1A,76B,105C 'page':17A,80B,128C 'privileg':93B 'publish':56B 'pypi':60B 'python':48B 'rfqr':25A 'server':5A,32A,36A,53B,55B,109C 'sourc':2A,82B,106C 'system':72B,120C 'tool':39B 'user':12A,75B,122C 'v1.1.1':110C 'via':11A,121C 'victim':70B,91B,119C 'vulner':6A 'w3q5':24A 'workstat':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running kubectl-mcp-server before 1.2.0 from npm or PyPI, most likely on a developer machine where the server is reachable by a browser the user also uses. The sources do not describe the exact configuration needed to reach the flaw, so a host that does not run the server can skip it. Teams already on 1.2.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-12T17:16:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-94gr-w3q5-rfqr","url":"https://github.com/advisories/GHSA-94gr-w3q5-rfqr","severity":"critical","published_at":"2026-05-12T18:30:38+00:00","modified_at":"2026-10-27T17:27:45+00:00","first_seen_at":"2026-10-27T17:32:35+00:00","fetched_at":"2026-10-27T17:32:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-65719","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65719","severity":null,"published_at":"2026-05-12T17:16:15+00:00","modified_at":"2026-10-26T21:10:00+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}