---
id: CVE-2026-61459
title: >-
  MCP Server Kubernetes before 3.9.0 contains an argument injection
  vulnerability in structured tools (kubectl_get, kubectl_describe,
  kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags
  security check by supplying re…
summary: >-
  MCP Server Kubernetes before 3.9.0 contains an argument injection
  vulnerability in structured tools (kubectl_get, kubectl_describe,
  kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags
  security check by supplying re…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-88
vendor: suyogs
product: mcp-server-kubernetes
affected:
  - mcp-server-kubernetes < 3.9.0
patched:
  - mcp-server-kubernetes 3.9.0
published: '2026-07-10'
updated: '2026-07-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61459'
references:
  - url: >-
      https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Flux159/mcp-server-kubernetes/issues/328'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Flux159/mcp-server-kubernetes/pull/329'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.02362
epssPercentile: 0.83039
ingestedAt: '2026-07-17T13:12:08.301Z'
exploitAvailable: true
exploits:
  exploitdb: true
  checkedAt: '2026-09-25T08:21:05.727Z'
---

## Overview

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

## Affected

- `mcp-server-kubernetes < 3.9.0`

## Remediation

Upgrade past the affected range:

- `mcp-server-kubernetes 3.9.0`