GitHub Advisoryadvisory · PyPI

GHSA-4hqq-7q79-932p mcp-kubernetes-server has an OS Command Injection vulnerability

CRITICAL Published 2025-09-15 Modified 2025-09-25 Official page ↗
Aliases
CVE-2025-59377
Ecosystem
PyPI
Packages
mcp-kubernetes-server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2025-09-15

Affected packages

• PyPI mcp-kubernetes-server: <= 0.1.11 (no fix yet)

Description

`feiskyer/mcp-kubernetes-server` through 0.1.11 allows OS command injection via the `/mcp/kubectl` endpoint. The handler constructs a shell command with user-supplied arguments and executes it with `subprocess` using `shell=True`, enabling injection through shell metacharacters (e.g., `;`, `&&`, `$()`), even when the server is running in read-only mode. A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability. This issue is distinct from `mcp-server-kubernetes` and from CVE-2025-53355.

Related

Alias · CVE (1)

  • CVE-2025-59377 feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References