CVE-2026-46519: high-severity vulnerability in Flux159 mcp-server-kubernetes
mcp-server-kubernetes Affected By Tool Access Control Bypass: Presentation-Layer Filtering Without Execution-Layer Enforcement
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Flux159 · mcp-server-kubernetesRelated CVEs — Flux159 mcp-server-kubernetes
In the same product, most dangerous first.
CVE-2026-61459CRITICALMCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured ToolsEPSS 2.4%CVE-2025-53355HIGHmcp-server-kubernetes vulnerable to command injection in several toolsEPSS 2.2%CVE-2025-66404MEDIUMmcp-server-kubernetes potential security issue in exec_in_pod toolEPSS 1.5%CVE-2026-47250MEDIUMmcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltrationEPSS 0.4%CVE-2026-39884HIGHMCP Server Kubernetes has Argument Injection in its port_forward tool via space-splittingEPSS 0.3%