CVE-2026-46519: mcp-server-kubernetes Access Control Bypass – Patch to 3.6.0

Technical summary

The vulnerability stems from a two-layer access control design where restrictions are validated inconsistently. The ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, and ALLOWED_TOOLS environment variables are checked during tool discovery (the tools/list operation) but not during tool execution (the tools/call operation). This creates a privilege escalation path: an attacker with valid credentials can enumerate available tool names through discovery, then directly invoke restricted tools by name via the execution layer without passing through the access control checks. The flaw is classified as improper access control (CWE-863) and carries a CVSS 3.1 score of 8.8 (HIGH), reflecting the confidentiality, integrity, and availability impact possible through authenticated cluster manipulation.

Business impact

Organizations using mcp-server-kubernetes with role-based access controls face a critical trust boundary failure. If access restrictions are deployed to prevent junior developers, third-party integrations, or automated systems from performing destructive cluster operations, those restrictions provide no genuine protection. An attacker with any valid credential—including a low-privilege API token—can delete resources, modify configurations, disrupt services, exfiltrate data, or poison cluster state. This undermines compliance frameworks that rely on access controls and creates risk in multi-tenant or shared-cluster environments.

Affected systems

mcp-server-kubernetes versions prior to 3.6.0 are affected. All configurations using ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, or ALLOWED_TOOLS environment variables are vulnerable, regardless of the specific restriction policy. Any deployment relying on these controls for security isolation is exposed.

Exploitability

Exploitation requires network access to the mcp-server-kubernetes endpoint and valid authentication credentials (PR:L in the CVSS vector). No complex attack chain is needed—a direct call to tools/call with a known tool name bypasses the restrictions entirely. The low complexity (AC:L) and lack of user interaction requirement (UI:N) mean exploitation is straightforward for any authenticated user aware of the tool interface. No special tools or knowledge of zero-day techniques are required.

Remediation

Upgrade mcp-server-kubernetes to version 3.6.0 or later, which enforces access controls consistently at both the discovery and execution layers. Review all cluster credentials and API tokens issued to users or systems relying on mcp-server-kubernetes access controls; assume those controls were ineffective before the upgrade and apply principle of least privilege during the remediation window. Verify that the patched version is in use across all deployments before releasing any sensitive cluster operations to untrusted users.

Patch guidance

Apply version 3.6.0 or any subsequent release. The patch closes the gap by validating the configured restriction mode before executing any tool, eliminating the bypass. Verify the patched version is running by checking the server version output and confirming the tools/call endpoint enforces the same restrictions as tools/list. Test in a staging cluster to ensure the restrictive behavior does not break legitimate automation before deploying to production.

Detection guidance

Monitor mcp-server-kubernetes audit logs and access patterns for calls to tools/call that would have been blocked by the restriction policy (e.g., destructive operations when ALLOW_ONLY_READONLY_TOOLS is set). Compare the tool names invoked via tools/call against the restriction rules to identify unauthorized operations. Ensure logging is enabled for all tool invocations. Look for authenticated sessions that use discovery (tools/list) followed by execution (tools/call) of tools that violate the stated policy, which may indicate awareness of the bypass.

Why prioritize this

This vulnerability rates HIGH priority due to the combination of high-impact blast radius (full cluster compromise possible), low exploitation friction (any authenticated user), and the prevalence of access controls in security-conscious deployments. Organizations using restrictive configurations are relying on controls that are completely ineffective, making immediate patching essential. The issue affects the integrity and availability of Kubernetes clusters, which are often critical infrastructure.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the HIGH severity: network-accessible service requiring only low-level authentication, low attack complexity, no user interaction, and unrestricted scope. The impact across confidentiality, integrity, and availability is complete (H:H/I:H/A:H) because an authenticated attacker gains full cluster control by executing any tool. This score is justified because the vulnerability nullifies the primary security mechanism organizations deploy on this server.

Frequently asked questions