CVE-2026-46519

The record

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.

Affected packages

Related vulnerabilities

• GHSA-cr22-wjx7-2w6m MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering… Same vulnerability
• CVE-2026-47250 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Also affects mcp-server-kubernetes
• GHSA-6mx4-4h42-r8vh MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token… Also affects mcp-server-kubernetes
• CVE-2026-39884 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Also affects mcp-server-kubernetes
• GHSA-4xqg-gf5c-ghwq MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting Also affects mcp-server-kubernetes
• GHSA-wvxp-jp4w-w8wg mcp-server-kubernetes has potential security issue in exec_in_pod tool Also affects mcp-server-kubernetes
• CVE-2025-66404 mcp-server-kubernetes has potential security issue in exec_in_pod tool Also affects mcp-server-kubernetes
• CVE-2025-54073 mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with… Also affects mcp-server-kubernetes