AI agent vulnerability · Other MCP servers and tools

CVE-2025-59377: mcp-kubernetes-server has an OS Command Injection vulnerability

criticalCVSS 3.1 9.8GHSA-4hqq-7q79-932p

feiskyer/mcp-kubernetes-server through 0.1.11 allows OS command injection via the /mcp/kubectl endpoint. The handler constructs a shell command with user-supplied arguments and executes it with subprocess using shell=True, enabling injection through shell metacharacters (e.g., ;, &&, $()), even when the server is running in read-only mode.

Published Sep 15, 2025 · Updated Sep 25, 2025

Affected packages

mcp-kubernetes-server

Ecosystem: PyPI
Affected: <= 0.1.11
Fixed in: No patched version yet
Check: pip show mcp-kubernetes-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

feiskyer/mcp-kubernetes-server through 0.1.11 allows OS command injection via the /mcp/kubectl endpoint. The handler constructs a shell command with user-supplied arguments and executes it with subprocess using shell=True, enabling injection through shell metacharacters (e.g., ;, &&, $()), even when the server is running in read-only mode.

A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability.

This issue is distinct from mcp-server-kubernetes and from CVE-2025-53355.

Credited to cai0duque.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries