kubectl-generic Flag Injection in mcp-server-kubernetes Leads to Bearer Token Leakage

Vulnerability Overview Vulnerability Name: Flag Injection Leads to Kubernetes Bearer Token Leakage Description: The tool in passes user-supplied flags directly to without any allowlist restrictions. Attackers can exploit this vulnerability for privilege escalation attacks, capturing Kubernetes Bearer Tokens by injecting flags even without access to the cluster or codebase. This vulnerability requires two flags: and to bypass HTTPS connection security features and trigger credential transmission. Scope of Impact Affected Versions: versions ≤ 3.6.2 (all versions) Fixed Versions: ≥ 3.7.0 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality: High - Integrity: None - Availability: None Remediation Fixed Version: Upgrade to version ≥ 3.7.0 POC Code Step 1 - Static Verification Step 2 - kubectl Behavior Test (Confirming HTTPS Requirement) Step 3 - Token Exfiltration via MCP Tool Invocation Impact Attacker Achievement: Privilege escalation in environments where the attacker already has limited cluster or codebase access. Kubernetes Bearer Token Leakage: The Kubernetes Bearer Token from the operator's kubeconfig is sent to the attacker's HTTPS server in the first Kubernetes API discovery request. RBAC Permissions: The captured token possesses RBAC permissions held by the operator's service account, which typically covers a broad scope in standard cluster management deployments. Direct Access: Attackers can directly use the captured token to access the real Kubernetes API, independent of the MCP server.

Goal Reached Thanks to every supporter — we hit 100%!

kubectl-generic Flag Injection in mcp-server-kubernetes Leads to Bearer Token Leakage

More from this source