A high-severity argument injection vulnerability in the mcp-server-kubernetes utility could allow unauthorized access to internal cluster services and cross-namespace targeting.

The flaw exists in the port_forward tool located in src/tools/port_forward.ts, where user-controlled input is improperly sanitized before being passed to a shell command. An authenticated attacker can exploit this argument injection to pass arbitrary flags to kubectl, such as binding services to all interfaces or accessing unauthorized namespaces.

The vulnerability carries a CVSS score of 8.3, reflecting the potential for significant unauthorized access within a Kubernetes environment. By injecting malicious flags into kubectl commands, an attacker could bypass network segmentation, expose sensitive internal microservices to the public network, or perform unauthorized actions across different namespaces, leading to potential data breaches and loss of cluster integrity.

Immediate Action: Update the mcp-server-kubernetes package to version 3.5.0 or later to resolve the argument injection flaw in the port_forward tool.

Proactive Monitoring: Review Kubernetes audit logs for unusual kubectl command executions or unexpected port forwarding activity originating from the Model Context Protocol server.

Compensating Controls: Restrict network access to the MCP server to trusted users only and implement strict RBAC policies for the service account running the server to limit the impact of potential command injection.

Public Exploit Available: No (exploit_available: unknown).

Given the critical nature of cluster management tools, it is imperative that organizations running mcp-server-kubernetes prioritize this update. The ability to inject arguments into kubectl commands poses a severe risk to cluster isolation, and administrators should move to version 3.5.0 immediately to eliminate this vector.