CVE-2026-61459

Affected software: MCP Server Kubernetes before 3.9.0. Vulnerability: Argument injection in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that bypasses the assertNoDangerousFlags check by using leading dashes for resourceType/name. This allows injection of the --server flag to ...

CVE-2026-39884

The CVE-2026-39884 entry concerns mcp-server-kubernetes (Model Context Protocol server for Kubernetes) with a vulnerability in the port_forward tool (src/tools/port_forward.ts). The code builds a kubectl command by string concatenation using user-controlled input and naively splits on spaces befo...

CVE-2025-66404

The CVE-2025-66404 entry concerns mcp-server-kubernetes. The exec_in_pod tool accepts a string command and passes it to a shell (sh -c) without input validation, enabling shell metacharacters to be interpreted. This creates potential for direct command injection or indirect prompt injection, allo...