CVE-2026-61459

Katalog CVE

CVSS 9.8 · Critical EPSS 2,4%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada suyogs mcp-server-kubernetes. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Flux159/mcp-server-kubernetes/issues/328 issue tracking · exploit · mitigasi · advisory vendor
• https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a patch
• https://github.com/Flux159/mcp-server-kubernetes/pull/329 issue tracking · patch
• https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools advisory pihak ketiga
• https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0 release notes