CVE-2026-61459: Flux159 MCP Server Kubernetes argument injection in kubectl tools

Executive brief

The MCP Server Kubernetes, a tool used to manage Kubernetes clusters, contains a security flaw that allows attackers to steal administrative credentials. By tricking the system into sending commands to a malicious server, an attacker can obtain the cluster's access tokens. This could lead to a full takeover of the Kubernetes environment and all the data or services running within it.

Technical details

An argument injection vulnerability (CWE-88) exists in the structured tools (kubectl_get, kubectl_describe, kubectl_delete) of mcp-server-kubernetes. Attackers can bypass the 'assertNoDangerousFlags' security check by providing 'resourceType' or 'name' parameters that begin with leading dashes. This allows the injection of the '--server' flag, which redirects kubectl commands to an attacker-controlled API server. When the command executes, the operator's bearer token is transmitted to the malicious server, potentially leading to full cluster compromise. The issue is fixed in version 3.9.0.

Affected products

• Flux159 mcp-server-kubernetes < 3.9.0

Timeline

• 2026-07-10: disclosed
• 2026-07-10: advisory
• 2026-07-10: patched: Fixed in version 3.9.0

References

• https://api.github.com/users/PercevalFox
• https://github.com/PercevalFox
• https://api.github.com/users/PercevalFox/gists%7B/gist_id%7D
• https://api.github.com/users/PercevalFox/repos
• https://avatars.githubusercontent.com/u/103103954?v=4
• https://api.github.com/users/PercevalFox/events%7B/privacy%7D