Executive brief
MCP Server Kubernetes is a tool that allows AI agents and other systems to manage Kubernetes clusters through command execution. The port_forward feature has a vulnerability where user-supplied input (pod names, namespaces) is improperly validated, allowing an attacker to inject malicious commands. An attacker can expose internal databases and services to the network, bypass access restrictions between namespaces, or trick AI agents into running unauthorized operations by embedding space-separated arguments in input fields.
Technical details
The port_forward tool in mcp-server-kubernetes constructs kubectl commands by concatenating user-controlled input (namespace, resourceType, resourceName, localPort, targetPort) into a string, then naively splitting on spaces before passing to spawn(). This argument injection vulnerability (CWE-88) allows attackers to inject arbitrary kubectl flags by embedding spaces in any user-controlled field. Unlike other tools in the codebase that correctly use array-based argument passing (execFileSync), port_forward uniquely uses string concatenation followed by .split(" "). Attack vectors include binding port-forwards to 0.0.0.0 to expose internal services network-wide, injecting duplicate -n flags to target unintended namespaces, and indirect exploitation via prompt injection where malicious pod names trick AI agents into running injected arguments. Exploitation requires network access and the ability to provide tool inputs (low privilege requirement). A fix is available in version 3.5.0 which replaces string-based construction with proper array-based argument passing.
Affected products
- Flux159 mcp-server-kubernetes <= 3.4.0
Timeline
- 2026-04-14: disclosed: Vulnerability published
- 2026-04-07: patched: Fix released in version 3.5.0