CVE-2026-47250

Name of the Vulnerable Software and Affected Versions mcp-server-kubernetes versions prior to 3.7.0

Description The kubectl generic tool in mcp-server-kubernetes passes user-supplied flags and arguments directly to kubectl without an allowlist, enabling a privilege escalation attack. An attacker with limited cluster or codebase access can inject a structured JSON line into application logs. If a privileged operator uses the MCP server to read these logs and their AI agent executes the injected instruction, the kubectl generic tool can be called with the --server and --insecure-skip-tls-verify flags. This causes kubectl to send all API requests, including the Authorization: Bearer <token> header from the operator's kubeconfig, to an attacker-controlled HTTPS endpoint. The captured token can then be replayed against the legitimate Kubernetes API server, granting the attacker the full RBAC permissions of the operator's service account.

Recommendations Update to version 3.7.0. As a temporary workaround, restrict the use of the kubectl generic tool or avoid reading logs from untrusted sources using the MCP server until the update is applied.