# CVE-2026-61459: Flux159 MCP Server Kubernetes argument injection in kubectl tools

Source: https://junglewise.ai/threats/cve-2026-61459-flux159-mcp-server-kubernetes-argument-injection-in-kubectl-tools  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-61459 · Severity: critical · CVSS 9.8 · Published 2026-07-10

The MCP Server Kubernetes, a tool used to manage Kubernetes clusters, contains a security flaw that allows attackers to steal administrative credentials. By tricking the system into sending commands to a malicious server, an attacker can obtain the cluster's access tokens. This could lead to a full takeover of the Kubernetes environment and all the data or services running within it.

Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61459 being exploited in the wild.

**How severe is CVE-2026-61459?** Critical severity, with a CVSS score of 9.8, published 10 July 2026.

**Which products and versions are affected?** mcp-server-kubernetes (PyPI) ECOSYSTEM:introduced=0,fixed=3.9.0.

**Is there a fix for CVE-2026-61459?** Yes. mcp-server-kubernetes (PyPI): upgrade to 3.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61459 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61459?** Check whether you run mcp-server-kubernetes (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mcp-server-kubernetes (PyPI): upgrade to 3.9.0 or later

  ```sh
  pip install "mcp-server-kubernetes>=3.9.0"
  ```


## Technical details

An argument injection vulnerability (CWE-88) exists in the structured tools (kubectl_get, kubectl_describe, kubectl_delete) of mcp-server-kubernetes. Attackers can bypass the 'assertNoDangerousFlags' security check by providing 'resourceType' or 'name' parameters that begin with leading dashes. This allows the injection of the '--server' flag, which redirects kubectl commands to an attacker-controlled API server. When the command executes, the operator's bearer token is transmitted to the malicious server, potentially leading to full cluster compromise. The issue is fixed in version 3.9.0.

## Affected products

- Flux159 mcp-server-kubernetes < 3.9.0

## Identifiers

- CVE-2026-61459
- GHSA-wmg3-h8mf-wgvr
- PYSEC-2026-3685

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Fixed in version 3.9.0

## References

- [https://api.github.com/users/PercevalFox](https://api.github.com/users/PercevalFox)
- [https://github.com/PercevalFox](https://github.com/PercevalFox)
- [https://api.github.com/users/PercevalFox/gists%7B/gist_id%7D](https://api.github.com/users/PercevalFox/gists%7B/gist_id%7D)
- [https://api.github.com/users/PercevalFox/repos](https://api.github.com/users/PercevalFox/repos)
- [https://avatars.githubusercontent.com/u/103103954?v=4](https://avatars.githubusercontent.com/u/103103954?v=4)
- [https://api.github.com/users/PercevalFox/events%7B/privacy%7D](https://api.github.com/users/PercevalFox/events%7B/privacy%7D)