GHSA-WVXP-JP4W-W8WG mcp-server-kubernetes has potential security issue in exec_in_pod tool

Summary A security issue exists in the execinpod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation sh -c without input validation, allowing shell...

@toolsdk.ai/registry (1.0.83) potentially affected by CVE-2025-66404 via mcp-server-kubernetes (2.4.3)

mcp-server-kubernetes NPM version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-server-kubernetes and may be impacted: - @toolsdk.ai/registry 1.0.83 Source cves: CVE-2025-66404 Source advisory: OSV:GHSA-WVXP-JP4W-W8WG...

CVE-2025-66404

The CVE-2025-66404 entry concerns mcp-server-kubernetes. The exec_in_pod tool accepts a string command and passes it to a shell (sh -c) without input validation, enabling shell metacharacters to be interpreted. This creates potential for direct command injection or indirect prompt injection, allo...

CVE-2025-66404 mcp-server-kubernetes potential security issue in exec_in_pod tool

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the execinpod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string...

EUVD-2025-201109

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the execinpod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string...

CVE-2025-66404 mcp-server-kubernetes potential security issue in exec_in_pod tool

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the execinpod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string...

PT-2025-48997

Name of the Vulnerable Software and Affected Versions MCP Server Kubernetes versions prior to 2.9.8 Description The MCP Server Kubernetes software contains a security issue in the exec in pod tool. The tool improperly handles user-provided commands in string format, passing them directly to shell...

MCP Server Kubernetes 命令注入漏洞

MCP Server Kubernetes is an MCP server for kubernetes management by Suyog Sonwalkar individual developer. A command injection vulnerability exists in MCP Server Kubernetes versions prior to 2.9.8, which stems from the execinpod tool failing to validate user input, which could lead to a command...

BIT-FLUX-2022-39272 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interv...

BIT-FLUX-2022-36035 Flux CLI Workload Injection

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...

EUVD-2025-200055

Malicious code in kubernetes-helm npm...

MAL-2025-191513 Malicious code in kubernetes-controller-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code...

EUVD-2025-200056

Malicious code in kubernetes-controller-tools npm...

Malicious code in kubernetes-helm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d507ab92764d5a31189e5fc42060eca5ba9b17fd8fc4d35de9ad266c1eb63144 The package kubernetes-helm was found to contain malicious code...

Malicious code in kubernetes-controller-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code...

MAL-2025-191514 Malicious code in kubernetes-helm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d507ab92764d5a31189e5fc42060eca5ba9b17fd8fc4d35de9ad266c1eb63144 The package kubernetes-helm was found to contain malicious code...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.7.3 release.

Red Hat Developer Hub 1.7.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

Moderate Photon OS Security Update - PHSA-2025-5.0-0698

Updates of 'kubernetes' packages of Photon OS have been released...

Portworx Half-Blind SSRF in kube-controller-manager

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - Medium 5.8 A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This was patched for other in-tree StorageClasses GlusterFS, Quobyte, StorageOS, and...

RLSA-2025:15904 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: podman: Podman kube play command may overwrite host files CVE-2025-9566 For more details about the security issues, including the impact, a CVSS score, acknowledgments...