kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

red-kube

基于kubectl的红队K8S对手模拟 Red Kube 是一组 kubectl 命令的集合，旨在从攻击者的角度评估 Kubernetes 集群的安全态势。 这些命令要么是被动的，用于数据收集和信息泄露；要么是主动的，用于执行实际影响集群的操作。 这些命令映射到 MITRE ATT&CK 战术，有助于了解我们在哪些方面存在最大的差距，并优先处理调查结果。 当前版本封装了一个 Python 编排模块，可以根据不同的场景或战术在一次运行中执行多个命令。 请谨慎使用，因为某些命令是主动的，会实际部署新容器或更改基于角色的访问控制配置。 警告：您不应在非自己拥有的 Kubernetes 集群上使...

CVE-2019-1002101-Helpers

kubectlcpCVE-2019-1002101 PoC helper scripts and Dockerfile for CVE-2019-1002101 For detailed info, goto https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/ and...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

rakkess

rakkess 审查访问权限 - 一个 kubectl 插件，用于显示服务器资源的访问矩阵 简介 你是否曾想过自己在提供的 Kubernetes 集群上拥有哪些访问权限？ 对于单个资源，你可以使用 kubectl auth can-i list deployments，但也许你正在寻找一个完整的概览？ 这就是 rakkess 的用途。 它会列出当前用户对所有服务器资源的访问权限，类似于 kubectl auth can-i --list。 它还可用于查找哪些主体可以访问某个服务器资源。 请查看子命令 rakkess resource，详见 下文。 演示 示例 显示所有资源的访问权限...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...

trivy-plugin-kubectl

trivy-plugin-kubectl A Trivy plugin that scans the images of a kubernetes resource Install root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl $ trivy kubectl -h Usage: trivy kubectl -h,--help TYPE NAME TRIVY OPTION A Trivy plugin that scans the images of a kubernet...

PYSEC-2026-3685 mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

CVE-2026-66782

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

CVE-2026-66782 Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

EUVD-2026-36073

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks...

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

Arbitrary Argument Injection

Overview mcp-server-kubernetes is a MCP server for interacting with Kubernetes clusters via kubectl Affected versions of this package are vulnerable to Arbitrary Argument Injection via the kubectlget, kubectldescribe, and kubectldelete functions. An attacker can execute arbitrary commands by...

CVE-2026-61459

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

EUVD-2026-42987

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

CVE-2026-61459

Affected software: MCP Server Kubernetes before 3.9.0. Vulnerability: Argument injection in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that bypasses the assertNoDangerousFlags check by using leading dashes for resourceType/name. This allows injection of the --server flag to ...

CVE-2026-61459 MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

PT-2026-57272

Name of the Vulnerable Software and Affected Versions MCP Server Kubernetes versions prior to 3.9.0 Description An argument injection issue exists in the structured tools kubectl get, kubectl describe, and kubectl delete. Improper input validation and argument parsing allow the resourceType and...

kubectl-cnpg-1.29.2-1.1 on GA media (moderate)

kubectl-cnpg-1.29.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11167-1 Rating: moderate Cross-References: CVE-2018-1058 CVE-2026-55765 CVE-2026-55769 CVSS scores: CVE-2018-1058 SUSE : 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that...