Live › vulnerability › CVE-2026-61459
Go to dashboardmcp-server-kubernetes before 3.9.0 lets a crafted resourceType or name with leading dashes pass the dangerous-flag check in kubectl_get, kubectl_describe and kubectl_delete. An attacker can inject --server to point kubectl at an attacker-controlled API server, sending the operator's bearer token there and enabling full cluster compromise.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:09 UTC, 0h before NVD. All times on this page are UTC.
Teams that run mcp-server-kubernetes as an MCP server connected to a Kubernetes cluster, where an AI agent or client can send it tool calls with user- or model-supplied resource names. The exposure depends on the agent reaching these structured tools with untrusted input. Teams on 3.9.0 or later, or not running this MCP server, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mcp-server-kubernetes | npm | < 3.9.0 | 3.9.0 |
| suyogs mcp-server-kubernetes | vendor | < 3.9.0 | 3.9.0 |
npm ls mcp-server-kubernetes in each project and in any global install to find the installed version.3.9.0.3.9.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-61459")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.