Argument Injection Vulnerability in mcp-server-kubernetes by Flux159

CVE-2026-39884

What is CVE-2026-39884?

The mcp-server-kubernetes tool has a significant argument injection vulnerability in its port_forward tool, affecting versions 3.4.0 and earlier. This vulnerability arises from constructing kubectl commands through string concatenation, which fails to securely handle user-supplied input. It leads to improper argument boundaries, permitting attackers to inject malicious kubectl flags. Exploiting this flaw can expose internal Kubernetes services publicly, facilitate cross-namespace access, and enable indirect threats to AI systems connected to the server. The issue has been addressed in version 3.5.0.

References