CVE-2026-39884: Flux159 mcp-server-kubernetes argument injection in port_forward

CVE-2026-39884 · Severity: high · CVSS 8.3 · Published 2026-04-15

MCP Server Kubernetes is a tool that allows AI agents and other systems to manage Kubernetes clusters through command execution. The port_forward feature has a vulnerability where user-supplied input (pod names, namespaces) is improperly validated, allowing an attacker to inject malicious commands. An attacker can expose internal databases and services to the network, bypass access restrictions between namespaces, or trick AI agents into running unauthorized operations by embedding space-separated arguments in input fields.

Technologies: mcp-server-kubernetes (npm). Vendors: npm.

Quick answers

Is CVE-2026-39884 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39884 being exploited in the wild.
How severe is CVE-2026-39884?
High severity, with a CVSS score of 8.3, published 15 April 2026.
Which products and versions are affected?
mcp-server-kubernetes (npm) <= 3.4.0, SEMVER:introduced=0,fixed=3.5.0.
Is there a fix for CVE-2026-39884?
Yes. mcp-server-kubernetes (npm): upgrade to 3.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39884 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39884?
Check whether you run mcp-server-kubernetes (npm) or Suyogs Mcp-Server-Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-server-kubernetes (npm): upgrade to 3.5.0 or later
    npm install mcp-server-kubernetes@3.5.0

Technical details

The port_forward tool in mcp-server-kubernetes constructs kubectl commands by concatenating user-controlled input (namespace, resourceType, resourceName, localPort, targetPort) into a string, then naively splitting on spaces before passing to spawn(). This argument injection vulnerability (CWE-88) allows attackers to inject arbitrary kubectl flags by embedding spaces in any user-controlled field. Unlike other tools in the codebase that correctly use array-based argument passing (execFileSync), port_forward uniquely uses string concatenation followed by .split(" "). Attack vectors include binding port-forwards to 0.0.0.0 to expose internal services network-wide, injecting duplicate -n flags to target unintended namespaces, and indirect exploitation via prompt injection where malicious pod names trick AI agents into running injected arguments. Exploitation requires network access and the ability to provide tool inputs (low privilege requirement). A fix is available in version 3.5.0 which replaces string-based construction with proper array-based argument passing.

Affected products

  • Flux159 mcp-server-kubernetes <= 3.4.0

Identifiers

  • CVE-2026-39884
  • GHSA-4xqg-gf5c-ghwq

Timeline

  • 2026-04-14: disclosed: Vulnerability published
  • 2026-04-07: patched: Fix released in version 3.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.