---
id: "CVE-2026-61459"
kind: "vulnerability"
aliases: ["CVE-2026-61459", "GHSA-wmg3-h8mf-wgvr"]
title: "mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials"
severity: "critical"
cvss: 9.8
epss: 0.02362
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mcp-server-kubernetes", "fixed": ["3.9.0"], "affected": "< 3.9.0", "ecosystem": "npm"}, {"name": "suyogs mcp-server-kubernetes", "fixed": ["3.9.0"], "affected": "< 3.9.0", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["ai-tooling", "claude-code", "cwe-88", "kubernetes", "mcp", "npm"]
not_affected_if: ["fixed-version", "no-mcp-server-kubernetes"]
published_at: "2026-07-10T19:17:27+00:00"
first_seen_at: "2026-10-28T15:09:08+00:00"
updated_at: "2026-10-28T15:33:37+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-wmg3-h8mf-wgvr", "first_seen_at": "2026-10-28T15:09:08+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61459", "first_seen_at": "2026-10-28T15:33:37+00:00"}]
---

# mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

mcp-server-kubernetes before 3.9.0 lets a crafted resourceType or name with leading dashes pass the dangerous-flag check in kubectl_get, kubectl_describe and kubectl_delete. An attacker can inject --server to point kubectl at an attacker-controlled API server, sending the operator's bearer token there and enabling full cluster compromise.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:mcp-server-kubernetes affected < 3.9.0 fixed 3.9.0
- vendor:suyogs mcp-server-kubernetes affected < 3.9.0 fixed 3.9.0

## How to check

- Run `npm ls mcp-server-kubernetes` in each project and in any global install to find the installed version.
- Check that the installed version is below `3.9.0`.

## Fix

- Upgrade mcp-server-kubernetes to `3.9.0` or later.
- Rotate any kubeconfig bearer tokens or service account tokens the server used, since they may have been sent to an external host.

## Timeline

- 2026-10-28T15:09:08+00:00 ghsa https://github.com/advisories/GHSA-wmg3-h8mf-wgvr
- 2026-10-28T15:33:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61459

## From the sources

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_