8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46519

CVE-2026-46519: mcp-server-kubernetes Affected By Tool Access Control Bypass: Presentation-Layer Filtering Without Execution-Layer Enforcement

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46519

CVE-2026-46519:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-server-kubernetes	npm	< 3.6.0	3.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-cr22-wjx7-2w6m, was an access control bypass in mcp-server-kubernetes. The server's configuration allows restricting available tools through environment variables, but this restriction was only enforced at the presentation layer (tools/list) and not at the execution layer (tools/call).

My analysis of the security patch confirms this. The fixing commit, 461b50c5beff2fbcba79e07f3ecb95746b82a093, modifies src/index.ts. The core of the vulnerability was within the anonymous handler function for CallToolRequestSchema, which is registered using server.setRequestHandler. This handler processed tools/call requests without any authorization checks.

The patch remediates this by introducing a new function, isToolAllowed, which encapsulates the access control logic. This function is then called at the beginning of the tools/call handler. If a tool is not allowed, the request is rejected with an error.

Therefore, the primary vulnerable function is the server.setRequestHandler for CallToolRequestSchema, which contained the flawed logic. An attacker would exploit this by sending a direct tools/call request for a restricted tool, which the server would have executed prior to the fix.

Vulnerable functions

server.setRequestHandler

src/index.ts

The vulnerability is in the anonymous async function passed as the handler to `server.setRequestHandler` for the `CallToolRequestSchema`. Prior to the patch, this handler would directly execute any tool requested via the 'tools/call' method without verifying if the tool was permitted by the server's configuration (e.g., `ALLOW_ONLY_READONLY_TOOLS`, `ALLOWED_TOOLS`). The patch introduces a call to the `isToolAllowed` function at the beginning of the handler to enforce these restrictions, throwing an error if a disallowed tool is called.

isToolAllowed

src/index.ts

This function was added as part of the fix to centralize the authorization logic. It checks if a given tool name is allowed based on the server's environment variable configuration. It is a key part of the mitigation but was absent in the vulnerable versions, leading to the bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.