CVE-2026-39884 Flux159 CVE debrief

Who should care

Kubernetes administrators and developers using mcp-server-kubernetes, especially those with exposure to internal Kubernetes services, should assess their deployment and take necessary actions to mitigate the vulnerability.

Why it matters

The vulnerability in mcp-server-kubernetes allows for argument injection in the port_forward tool, enabling exposure of internal Kubernetes services, cross-namespace targeting, and indirect exploitation via prompt injection. Kubernetes administrators and developers should assess their deployment and take necessary actions to mitigate the vulnerability.

• Exposure of internal Kubernetes services to the network
• Cross-namespace targeting via additional -n flags
• Indirect exploitation via prompt injection against AI agents connected to the MCP server
• Verification of affected versions and remediation priority

Technical summary

The mcp-server-kubernetes package is vulnerable to argument injection in the port_forward tool due to improper handling of user-controlled input. This allows an attacker to inject arbitrary kubectl flags, potentially leading to exposure of internal Kubernetes services, cross-namespace targeting, and indirect exploitation via prompt injection. The vulnerability is caused by string concatenation with user-controlled input in the port_forward tool, which is then passed to spawn(). The affected versions are 3.4.0 and prior, and the fix is in version 3.5.0.

Defensive priority

High priority for Kubernetes administrators and developers using mcp-server-kubernetes, especially those with exposure to internal Kubernetes services.

Recommended defensive actions

• Upgrade to version 3.5.0 or later
• Review and restrict access to the port_forward tool
• Monitor for suspicious activity in Kubernetes clusters
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by string concatenation with user-controlled input in the port_forward tool, which is then passed to spawn(). This allows an attacker to inject arbitrary kubectl flags. The affected versions are 3.4.0 and prior, and the fix is in version 3.5.0. Kubernetes administrators and developers should verify their deployments and take necessary actions to mitigate the vulnerability. The port_forward tool is used for forwarding traffic from a local port to a port on a Kubernetes resource. The vulnerability can be used

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.