EUVD-2025-209796
GHSA-94gr-w3q5-rfqr
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.
AnalysisAI
Remote code execution in Kubectl MCP Server v1.1.1 allows unauthenticated network attackers to execute arbitrary commands on systems running the vulnerable server through crafted HTML-based exploitation vectors. Despite a critical 9.8 CVSS score, EPSS rates exploitation likelihood at only 0.02% (4th percentile), suggesting limited real-world targeting thus far. The vulnerability is classified as CWE-94 (Code Injection), affecting an open-source Model Context Protocol (MCP) server implementation for Kubernetes management. No CISA KEV listing indicates absence of confirmed widespread exploitation at time of analysis.
Technical ContextAI
Kubectl MCP Server is an open-source implementation of Anthropic's Model Context Protocol (MCP) designed to enable AI assistants to interact with Kubernetes clusters through kubectl commands. The vulnerability stems from improper neutralization of special elements used in commands (CWE-94 Code Injection), allowing untrusted input to be executed as code. While specifics of the injection vector are not detailed in available data, the requirement for user interaction with a crafted HTML page suggests a browser-based attack vector, potentially exploiting insufficient input validation in web-facing components or endpoints that process external data. The MCP architecture's bridging of AI interfaces with privileged Kubernetes operations creates a high-impact attack surface when input sanitization fails. CPE data shows 'n/a' vendor and product fields, reflecting the open-source nature and limited formal cataloging of this component.
RemediationAI
Review the GitHub repository at github.com/rohitg00/kubectl-mcp-server for patched releases post-v1.1.1, as no specific fix version is confirmed in NVD data at time of analysis. Consult OX Security's detailed advisories at ox.security/blog/cve-2025-65719-critical-rce-in-kubectl-mcp-server for vendor-recommended mitigation guidance. If no patch is available, implement compensating controls: isolate Kubectl MCP Server instances to dedicated network segments with strict ingress/egress filtering, disable web-accessible endpoints if feasible (may break intended AI assistant integration), enforce principle of least privilege for Kubernetes RBAC bindings associated with the MCP server's service account (limit blast radius of code execution), and implement application-layer filtering to block HTML content delivery through MCP interfaces (may impact legitimate use cases requiring rich formatting). Deploy endpoint detection and response (EDR) on systems running the server to detect post-exploitation activity. Given the user-interaction requirement, security awareness training on phishing risks is a necessary supplementary control.
Share
External POC / Exploit Code
Leaving vuln.today