CVE-2026-61459 MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
Attackers can inject arguments into kubectl tools to steal bearer tokens and compromise the Kubernetes cluster.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61459?
CVE-2026-61459 is a critical command injection vulnerability in Flux159 mcp-server-kubernetes, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
Weakness: CWE-88
Which versions are affected by CVE-2026-61459?
3 open source packages ship an affected version, including mcp-server-kubernetes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mcp-server-kubernetes PyPI | All versions | 3.9.0 |
mcp-server-kubernetes npm | All versions | 3.9.0 |
mcp-server-kubernetes npm | All versions | 3.9.0 |
Products include Suyogs Mcp-Server-Kubernetes.
How do I fix CVE-2026-61459?
Upgrade mcp-server-kubernetes to 3.9.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-61459 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61459 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Flux159 mcp-server-kubernetes
Sources
Also known as GHSA-wmg3-h8mf-wgvr, PYSEC-2026-3685.