Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-61459MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

Critical 9.8

In plain English

A critical-severity argument injection in mcp-server-kubernetes from Flux159. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.4%top 16.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mcp-server-kubernetes	3.9.0	PYSEC-2026-3685
npm	mcp-server-kubernetes	3.9.0	GHSA-wmg3-h8mf-wgvr

Affected products (as reported)

Vendor	Product	Versions
Flux159	mcp-server-kubernetes	0 – before 3.9.0

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Researcher Disclosure exploit, technical-description
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools third-party-advisory