Executive brief
mcp-server-kubernetes is a server that enables large language models and tools to interact with Kubernetes clusters. A command injection vulnerability in its kubectl tools allows attackers to execute arbitrary system commands on the host running the server. An attacker can craft malicious input or inject commands through pod logs to gain complete control over the Kubernetes environment and underlying infrastructure.
Technical details
The vulnerability is a command injection flaw in the mcp-server-kubernetes MCP Server, where user-supplied input parameters are directly concatenated into shell commands executed via child_process.execSync without sanitization. Multiple tools are affected, including kubectl_scale, kubectl_patch, and explain_resource. The vulnerable code constructs kubectl commands by directly embedding unsanitized input (e.g., namespace, resource name, replica count), allowing shell metacharacter injection (|, >, &&, ;, etc.). An attacker can trigger exploitation through direct tool invocation or indirectly via prompt injection by embedding malicious instructions in Kubernetes pod logs that are then read by the MCP client. Successful exploitation leads to remote code execution under the server process privileges. The vulnerability has been patched in version 2.5.0 and later.
Affected products
- Flux159 mcp-server-kubernetes <=2.4.9
Timeline
- 2025-07-08: disclosed: Vulnerability published
- 2025-07-08: patched: Patched in version 2.5.0