CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-61459 — MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability ...

·Source: NIST NVD

Updated:

Executive Summary

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causi

Analysis

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise. CVSS Score: 9.8. Published: 2026-07-10T19:17:27.450.

Indicators of Compromise (1)

CVE (1)
CVE-2026-61459
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Wireshark 4.6.7 Released, (Sat, Jul 11th)

Wireshark release 4.6.7 fixes 12 vulnerabilities and 16 bugs.

SANS ISC
CRITICALVulnerability

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in arbitrary code execution. The vulnerability has been described as a case of stored cross-site scripting (XSS) that could allow specially crafted emails to execute malicious scripts in a user's session. It has yet to be assigned a CVE identifier. "The

The Hacker News
LOWVulnerability

When Hackers Cut the Internet, Will the Water Still Flow?

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/when-hackers-cut-internet-will-water-still-flow-image_small-1-a-32204.jpg" align=right hspace=4><b>EPA Drills Water Utilities to Disconnect</b><br>It's 4:45 a.m. and the internet has gone down. For the next three days, a fictional water utility will have to figure out how to keep its 120,000 customers' water supply flowing and saf

Bank Info Security