GHSA-6mx4-4h42-r8vh
Medium · 6.1CVSS
6.1
EPSS
—
Published
Jun 5, 2026
CISA due date
—
The record
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | mcp-server-kubernetes | 0 | 3.7.0 |
Related vulnerabilities
- CVE-2026-47250 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Same vulnerability
- CVE-2026-46519 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Also affects mcp-server-kubernetes
- GHSA-cr22-wjx7-2w6m MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering… Also affects mcp-server-kubernetes
- CVE-2026-39884 mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster… Also affects mcp-server-kubernetes
- GHSA-4xqg-gf5c-ghwq MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting Also affects mcp-server-kubernetes
- GHSA-wvxp-jp4w-w8wg mcp-server-kubernetes has potential security issue in exec_in_pod tool Also affects mcp-server-kubernetes
- CVE-2025-66404 mcp-server-kubernetes has potential security issue in exec_in_pod tool Also affects mcp-server-kubernetes
- CVE-2025-54073 mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with… Also affects mcp-server-kubernetes