kubectl-mcp-server CVE-2025-69902
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Command injection yields full RCE (C/I/A High, AC:L); PR:N/AV:N retained assuming a network-exposed or unauthenticated MCP transport, though local-stdio deployments would justify AV:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
AnalysisAI
Command execution in kubectl-mcp-server v1.2.0 (the kubectl-mcp-tool PyPI package) is possible because the minimal_wrapper.py component passes attacker-controllable input to a shell without sanitizing metacharacters, letting an attacker inject arbitrary OS commands (CWE-94). Because this MCP server brokers kubectl access to Kubernetes clusters, successful injection can compromise the host and, via cluster credentials, the wider Kubernetes environment. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.11%, 30th percentile) despite the 9.8 CVSS score.
Technical ContextAI
kubectl-mcp-server is a Model Context Protocol (MCP) server that exposes kubectl functionality as tools an AI agent/LLM can invoke to manage Kubernetes clusters. The flaw lives in kubectl_mcp_tool/minimal_wrapper.py, a wrapper that builds and runs kubectl (or shell) commands from supplied arguments. Per CWE-94 (Code/Command Injection), the wrapper interpolates untrusted input directly into a shell invocation (e.g. via shell=True or string concatenation) instead of passing an argument vector, so shell metacharacters such as ;, |, &&, $(), and backticks break out of the intended kubectl command and execute arbitrary OS commands with the privileges of the MCP server process. The CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so exact affected boundaries must be taken from the description and the GitHub source file rather than NVD's CPE dictionary.
RemediationAI
No vendor-released patch version is identified in the available data, and no fix PR or tagged release is cited, so a specific upgrade target cannot be confirmed - monitor the project's GitHub releases (https://github.com/rohitg00/kubectl-mcp-server) and PyPI (https://pypi.org/project/kubectl-mcp-tool) for a version newer than 1.2.0 and upgrade once published. As compensating controls until then: run the MCP server only over local stdio transport driven by a trusted client rather than exposing it on a network socket; if network exposure is required, place it behind authentication and network ACLs restricting access to known clients; run the server as an unprivileged, sandboxed user with a minimal kubeconfig/RBAC-scoped service account so that command execution cannot pivot to cluster-admin (trade-off: reduced functionality for the AI agent); and consider removing or wrapping minimal_wrapper.py, or validating/allow-listing arguments and disabling shell interpretation (execute kubectl via an argument vector, not a shell string). Review the AhnLab ASEC (https://asec.ahnlab.com/ko/92922/) and VulDB (https://vuldb.com/?id.351333) advisories for further detail.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today