CVE-2025-53355: mcp-server-kubernetes command injection in kubectl tools

CVE-2025-53355 · Severity: low · CVSS 3.1 · Published 2025-07-08

mcp-server-kubernetes is a server that enables large language models and tools to interact with Kubernetes clusters. A command injection vulnerability in its kubectl tools allows attackers to execute arbitrary system commands on the host running the server. An attacker can craft malicious input or inject commands through pod logs to gain complete control over the Kubernetes environment and underlying infrastructure.

Technologies: mcp-server-kubernetes (npm). Vendors: npm.

Quick answers

Is CVE-2025-53355 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-53355 being exploited in the wild.
How severe is CVE-2025-53355?
Low severity, with a CVSS score of 3.1, published 8 July 2025.
Which products and versions are affected?
mcp-server-kubernetes (npm) SEMVER:introduced=0,fixed=2.5.0.
Is there a fix for CVE-2025-53355?
Yes. mcp-server-kubernetes (npm): upgrade to 2.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-53355 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-53355?
Check whether you run mcp-server-kubernetes (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-server-kubernetes (npm): upgrade to 2.5.0 or later
    npm install mcp-server-kubernetes@2.5.0

Technical details

The vulnerability is a command injection flaw in the mcp-server-kubernetes MCP Server, where user-supplied input parameters are directly concatenated into shell commands executed via child_process.execSync without sanitization. Multiple tools are affected, including kubectl_scale, kubectl_patch, and explain_resource. The vulnerable code constructs kubectl commands by directly embedding unsanitized input (e.g., namespace, resource name, replica count), allowing shell metacharacter injection (|, >, &&, ;, etc.). An attacker can trigger exploitation through direct tool invocation or indirectly via prompt injection by embedding malicious instructions in Kubernetes pod logs that are then read by the MCP client. Successful exploitation leads to remote code execution under the server process privileges. The vulnerability has been patched in version 2.5.0 and later.

Affected products

  • Flux159 mcp-server-kubernetes <=2.4.9

Identifiers

  • CVE-2025-53355
  • GHSA-gjv4-ghm7-q58q

Timeline

  • 2025-07-08: disclosed: Vulnerability published
  • 2025-07-08: patched: Patched in version 2.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.