GHSA-cr22-wjy7-2w6m: mcp-server-kubernetes Tool Access Control Bypass (RCE via tools/call)

Vulnerability Overview Vulnerability Name: Tool Access Control Bypass: Presentation-Layer Filtering Without Execution-Layer Enforcement Vulnerability ID: GHSA-cr22-wjy7-2w6m Severity: High (8.8 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Affected Versions: = 3.6.0 Release Date: 2025-06-15 Description exposes three environment variables ( , , ) as access controls to restrict available Kubernetes operations. These controls are enforced only at the tool discovery layer ( ) but not at the execution layer ( ). Any client that knows the tool name can bypass the configured access control policy. This access control is essentially decorative. Impact An attacker or misconfigured AI agent with network access to the MCP server's HTTP endpoint can invoke any Kubernetes tool, regardless of the operator-configured access control policy (including , , , and ). The project explicitly supports and documents multi-client HTTP deployment scenarios (streaming HTTP and SSE transport, cluster-internal deployment, Codes CLI, and Gemini CLI integration). In these deployments, operators rely on tool restriction environment variables to enforce least-privilege access across users or roles. This bypass renders that model entirely ineffective. The severity is proportional to the permissions of the Kubernetes service account. In environments where the MCP server runs as (common in development), this is equivalent to any client with access to the endpoint gaining complete control over the entire cluster. The / mechanism controls who can access the endpoint but does not provide per-tool authorization. An authenticated client, even if restricted to , can still call after authentication. Root Cause In , the handler applies the configured filtering logic before returning available tools. The handler dispatches directly by tool name without an equivalent check—each tool is accessible unconditionally. Proof of Concept (POC) Tested on a real Kubernetes cluster under three restriction modes. In each case, was missing from , but execution succeeded via a direct request. Result: Confirmed under , , and . Remediation The fix applies the same filtering logic found in at the beginning of the handler, returning an error for any tool invocation outside the allowed set. Fixed in v3.6.0. Credits Discovered by Francisco Rosales, coordinated by Manifold Security, and coordinated by Ar Sharma, Research Lead at Manifold Security.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-cr22-wjy7-2w6m: mcp-server-kubernetes Tool Access Control Bypass (RCE via tools/call)

More from this source