GHSA-4xqg-gf5c-ghwq
High · 8.3CVSS
8.3
EPSS
—
Published
Apr 14, 2026
CISA due date
—
The record
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | mcp-server-kubernetes | 0 | 3.5.0 |
Related vulnerabilities
- CVE-2026-39884 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Same vulnerability
- CVE-2026-47250 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Also affects mcp-server-kubernetes
- CVE-2026-46519 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Also affects mcp-server-kubernetes
- GHSA-6mx4-4h42-r8vh MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token… Also affects mcp-server-kubernetes
- GHSA-cr22-wjx7-2w6m MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering… Also affects mcp-server-kubernetes
- GHSA-wvxp-jp4w-w8wg mcp-server-kubernetes has potential security issue in exec_in_pod tool Also affects mcp-server-kubernetes
- CVE-2025-66404 mcp-server-kubernetes has potential security issue in exec_in_pod tool Also affects mcp-server-kubernetes
- CVE-2025-54073 mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with… Also affects mcp-server-kubernetes