3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59376

CVE-2025-59376: mcp-kubernetes-server has a Command Injection vulnerability

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod" command because the first word (i.e., "version") is not a write or delete operation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59376

CVE-2025-59376:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-kubernetes-server	pip	<= 0.1.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the mcp-kubernetes-server because of improper input validation in the functions that handle kubectl and helm commands. The core of the issue lies in the kubectl and helm wrapper functions within src/mcp_kubernetes_server/main.py. These functions are designed to restrict certain subcommands when the server is started with --disable-write or --disable-delete flags.

The security mechanism in place splits the incoming command string by whitespace and only checks the very first word (or the first two, in the case of some helm commands) against a blocklist of disallowed operations. This creates a classic command injection vulnerability. An attacker can bypass the filter by providing a command that starts with a harmless, allowed operation, followed by a semicolon (;) or other shell command separator, and then the malicious command. For example, a command like kubectl version; kubectl delete pod critical-pod will pass the validation because the check only sees version, which is a read-only operation. The entire string is then passed to a shell for execution, leading to the deletion of the pod, bypassing the intended security control.

The same flaw exists in the helm command wrapper. Both functions fail to properly sanitize or validate the entire command string before execution, making them vulnerable to command chaining and injection.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.