{"id":"CVE-2025-59376","aliases":["GHSA-hjm5-xgj8-vwj6","PYSEC-2026-1619"],"title":"mcp-kubernetes-server has a Command Injection vulnerability","summary":"mcp-kubernetes-server has a Command Injection vulnerability","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","vendor":"mcp-kubernetes-server","product":"mcp-kubernetes-server","ecosystem":"pip","affected":["mcp-kubernetes-server <= 0.1.11"],"published":"2025-09-15","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hjm5-xgj8-vwj6","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59376"},{"url":"https://github.com/feiskyer/mcp-kubernetes-server"},{"url":"https://github.com/feiskyer/mcp-kubernetes-server/blob/78957b6c1a3982080cf6fcaac6f6e9014116a71c/src/mcp_kubernetes_server/main.py#L106-L137"},{"url":"https://github.com/william31212/CVE-Requests-1896609"}],"tags":["osv","pip","exploit-available"],"epss":0.00302,"epssPercentile":0.23103,"ingestedAt":"2026-07-08T18:25:50.259Z","exploits":{"github":1,"githubRepos":["https://github.com/william31212/CVE-Requests-1896609"],"checkedAt":"2026-09-23T07:13:37.364Z"},"exploitAvailable":true,"slug":"CVE-2025-59376","body":"## Overview\n\n`mcp-kubernetes-server` does not correctly enforce the `--disable-write` / `--disable-delete` protections when commands are chained. The server only inspects the first token to decide whether an operation is write/delete, which allows a read-like command to be followed by a write action using shell metacharacters (e.g., `kubectl version; kubectl delete pod <name>`). A remote attacker who can invoke the server may therefore bypass the intended write/delete restrictions and perform state-changing operations against the Kubernetes cluster.\n\n**Affected versions:** through `0.1.11` (no patched release available as of now).\n\n**Mitigations:**\n- Run with `--disable-kubectl` and/or `--disable-helm` to fully block those execution paths.\n- Put the server behind an allow-list proxy restricting allowed subcommands.\n\n## Affected packages\n\n- `mcp-kubernetes-server <= 0.1.11`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4847,"id":"CVE-2025-59376","ts":1788887211495,"field":"exploit_available","old":"false","new":"true"},{"seq":3730,"id":"CVE-2025-59376","ts":1788886327606,"field":"exploit_available","old":"true","new":"false"},{"seq":2575,"id":"CVE-2025-59376","ts":1788883009177,"field":"exploit_available","old":"false","new":"true"},{"seq":1604,"id":"CVE-2025-59376","ts":1788882409052,"field":"exploit_available","old":"true","new":"false"},{"seq":715,"id":"CVE-2025-59376","ts":1788881846439,"field":"exploit_available","old":"false","new":"true"}]}