CVE-2026-46519 MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
Attackers can bypass Kubernetes operation restrictions in mcp-server-kubernetes by invoking tools directly, ignoring configured access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46519?
CVE-2026-46519 is a high-severity missing authorization vulnerability in Flux159 mcp-server-kubernetes, published on 11 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-46519?
2 open source packages ship an affected version, including mcp-server-kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
mcp-server-kubernetes npm | All versions | 3.6.0 |
mcp-server-kubernetes npm | All versions | 3.6.0 |
Linux distribution packages (2)
atril openSUSE:Leap 16.0 | All versions | 1.28.4-bp160.1.1 |
atril openSUSE:Tumbleweed | All versions | 1.28.4-1.1 |
How do I fix CVE-2026-46519?
Upgrade mcp-server-kubernetes to 3.6.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-46519 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46519 exists.
Sources
Also known as GHSA-cr22-wjx7-2w6m, openSUSE-SU-2026:10914-1, openSUSE-SU-2026:21152-1.