CVE-2025-59377: Mcp-kubernetes-server RCE Vulnerability

CVE-2025-59377 Overview

CVE-2025-59377 is a critical OS command injection vulnerability affecting feiskyer mcp-kubernetes-server through version 0.1.11. The vulnerability exists in the /mcp/kubectl endpoint where user-supplied input is passed to a shell command with shell=True enabled, allowing attackers to inject arbitrary operating system commands. Notably, this vulnerability is exploitable even when the server is configured in read-only mode, bypassing intended security restrictions.

Critical Impact
Remote attackers can execute arbitrary OS commands on the underlying server without authentication, potentially leading to complete system compromise, data exfiltration, and lateral movement within Kubernetes environments.

Affected Products

feisky mcp-kubernetes-server versions through 0.1.11

Discovery Timeline

2025-09-15 - CVE-2025-59377 published to NVD
2025-09-20 - Last updated in NVD database

Technical Details for CVE-2025-59377

Vulnerability Analysis

This command injection vulnerability (CWE-78) stems from the unsafe handling of user input in the mcp-kubernetes-server's kubectl command execution functionality. The application passes untrusted input directly to a subprocess call with shell=True, which interprets shell metacharacters and allows command chaining. An attacker can leverage standard shell operators such as semicolons, pipes, or command substitution to execute arbitrary commands alongside legitimate kubectl operations.

The vulnerability is particularly dangerous because it bypasses the application's read-only mode protection. While read-only mode is designed to prevent destructive operations, the command injection occurs at the shell level before any read-only checks are applied, rendering this security control ineffective.

Root Cause

The root cause is the use of shell=True in Python's subprocess execution when handling user-controlled input in the command.py module. When shell=True is passed to subprocess functions, the command string is passed through the system shell, which interprets shell metacharacters. Any unsanitized user input containing characters like ;, |, &&, $(), or backticks can be used to chain additional commands.

The vulnerable code is located in command.py at line 38.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker sends a crafted HTTP request to the /mcp/kubectl endpoint containing malicious shell metacharacters within the kubectl command parameters. The server processes this input without proper sanitization, passing it directly to a shell subprocess where the injected commands are executed with the privileges of the server process.

For example, an attacker could append shell commands using semicolons or pipe operators to exfiltrate sensitive Kubernetes secrets, establish reverse shells, or pivot to other systems within the cluster. Technical details and proof-of-concept information can be found in the CVE Requests repository.

Detection Methods for CVE-2025-59377

Indicators of Compromise

Unusual process spawning from the mcp-kubernetes-server process, particularly shells (/bin/sh, /bin/bash) or common post-exploitation tools
HTTP requests to /mcp/kubectl containing shell metacharacters such as ;, |, &&, ||, $(), or backticks
Outbound network connections from the server to unexpected external IP addresses
Creation of unexpected files or modification of system configurations on the host running mcp-kubernetes-server

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests containing shell metacharacters in kubectl parameters
Monitor subprocess creation events from the mcp-kubernetes-server process using endpoint detection tools
Deploy network monitoring to identify anomalous outbound connections that may indicate reverse shell activity
Review application logs for malformed or suspicious kubectl commands that contain special characters

Monitoring Recommendations

Enable verbose logging for all requests to the /mcp/kubectl endpoint and regularly audit for suspicious patterns
Configure alerting for process execution chains where mcp-kubernetes-server spawns unexpected child processes
Implement real-time monitoring of file system changes on hosts running the vulnerable server
Monitor Kubernetes audit logs for unusual API operations that may result from command injection exploitation

How to Mitigate CVE-2025-59377

Immediate Actions Required

Discontinue use of mcp-kubernetes-server versions 0.1.11 and earlier in production environments until a patched version is available
Implement network segmentation to restrict access to the mcp-kubernetes-server endpoint to trusted sources only
Deploy a web application firewall or reverse proxy with rules to block requests containing shell metacharacters
Monitor the mcp-kubernetes-server repository for security updates and patches

Patch Information

At the time of publication, no official patch has been released by the vendor. Organizations should monitor the project repository and security advisories for updates. The fix requires modifying the subprocess execution to use shell=False and passing arguments as a list rather than a shell command string.

Workarounds

Restrict network access to the mcp-kubernetes-server to only trusted IP addresses using firewall rules or network policies
Place the server behind an authenticating reverse proxy that requires strong authentication before forwarding requests
Implement input validation at the proxy or WAF level to strip or reject requests containing shell metacharacters
Consider deploying alternative MCP Kubernetes solutions that do not have this vulnerability

bash

# Example: Restrict access using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP