What is the CVSS score of CVE-2025-65719?

CVE-2025-65719 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Kubectl MCP Server are affected by CVE-2025-65719?

Kubectl MCP Server v1.1.1 contains a critical remote code execution vulnerability (CVSS 9.8) allowing unauthenticated attackers to execute arbitrary commands, but current exploitation probability…. A patch is available.

How to fix or mitigate CVE-2025-65719?

Within 24 hours: Identify all systems running Kubectl MCP Server v1.1.1 and document network exposure (internet-facing vs. internal-only). Within 7 days: Isolate affected servers from untrusted networks, implement network segmentation if internet-exposed, and monitor for anomalous command execution. Within 30 days: Migrate to the next available patched version when released by the project maintainers, or discontinue use if no patch roadmap is published.

Kubectl MCP Server CVE-2025-65719

EUVD-2025-209796 CRITICAL

Code Injection (CWE-94)

2026-05-12 mitre

GHSA-94gr-w3q5-rfqr

Code Injection RCE N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 16:23 vuln.today

CVSS changed

May 13, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.

AnalysisAI

Remote code execution in Kubectl MCP Server v1.1.1 allows unauthenticated network attackers to execute arbitrary commands on systems running the vulnerable server through crafted HTML-based exploitation vectors. Despite a critical 9.8 CVSS score, EPSS rates exploitation likelihood at only 0.02% (4th percentile), suggesting limited real-world targeting thus far. The vulnerability is classified as CWE-94 (Code Injection), affecting an open-source Model Context Protocol (MCP) server implementation for Kubernetes management. No CISA KEV listing indicates absence of confirmed widespread exploitation at time of analysis.

Technical ContextAI

Kubectl MCP Server is an open-source implementation of Anthropic's Model Context Protocol (MCP) designed to enable AI assistants to interact with Kubernetes clusters through kubectl commands. The vulnerability stems from improper neutralization of special elements used in commands (CWE-94 Code Injection), allowing untrusted input to be executed as code. While specifics of the injection vector are not detailed in available data, the requirement for user interaction with a crafted HTML page suggests a browser-based attack vector, potentially exploiting insufficient input validation in web-facing components or endpoints that process external data. The MCP architecture's bridging of AI interfaces with privileged Kubernetes operations creates a high-impact attack surface when input sanitization fails. CPE data shows 'n/a' vendor and product fields, reflecting the open-source nature and limited formal cataloging of this component.

RemediationAI

Review the GitHub repository at github.com/rohitg00/kubectl-mcp-server for patched releases post-v1.1.1, as no specific fix version is confirmed in NVD data at time of analysis. Consult OX Security's detailed advisories at ox.security/blog/cve-2025-65719-critical-rce-in-kubectl-mcp-server for vendor-recommended mitigation guidance. If no patch is available, implement compensating controls: isolate Kubectl MCP Server instances to dedicated network segments with strict ingress/egress filtering, disable web-accessible endpoints if feasible (may break intended AI assistant integration), enforce principle of least privilege for Kubernetes RBAC bindings associated with the MCP server's service account (limit blast radius of code execution), and implement application-layer filtering to block HTML content delivery through MCP interfaces (may impact legitimate use cases requiring rich formatting). Deploy endpoint detection and response (EDR) on systems running the server to detect post-exploitation activity. Given the user-interaction requirement, security awareness training on phishing risks is a necessary supplementary control.