{"id":"EUVD-2026-36286","enisaUuid":"1ca9c3ab-bc7f-372e-8cb5-e947df1bb515","description":"mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.","datePublished":"Jun 11, 2026, 6:34:15 PM","dateUpdated":"Jun 11, 2026, 7:40:22 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m\nhttps://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.6.0\n","aliases":"CVE-2026-46519\nGHSA-cr22-wjx7-2w6m\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"38633b56-4cee-3759-88b1-ca3b7fd52b69","product":{"name":"mcp-server-kubernetes","vendor":{"name":"Flux159"}},"product_version":"\u003c 3.6.0"}],"enisaIdVendor":[{"id":"15881c38-c32f-3b76-b597-bb41593ae856","vendor":{"name":"Flux159"}}],"enisaIdVulnerability":[{"id":"47f59f90-4fef-358e-97a4-482e553132d4","vulnerability":{"id":"CVE-2026-46519","description":"mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.","datePublished":"Jun 11, 2026, 6:34:15 PM","dateUpdated":"Jun 11, 2026, 7:40:22 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m\nhttps://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.6.0\n","enisa_id":"EUVD-2026-36286\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Oct 30, 2026, 7:18:29 AM","vulnerabilityProduct":[{"id":"d8bb7d56-e479-34ec-84da-dfc997f67bd2","product":{"name":"mcp-server-kubernetes","vendor":{"name":"Flux159"}},"product_version":"\u003c 3.6.0"}],"vulnerabilityVendor":[{"id":"443475ff-c06b-34f5-8e59-8f56e24dd9a4","vendor":{"name":"Flux159"}}]}},{"id":"f4d04344-7fbb-3e88-bb27-adb57d6eaa3e","vulnerability":{"id":"GHSA-cr22-wjx7-2w6m","description":"MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement","datePublished":"May 21, 2026, 8:33:46 PM","dateUpdated":"Jun 12, 2026, 7:26:31 PM","baseScore":0.0,"references":"https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46519\nhttps://github.com/Flux159/mcp-server-kubernetes\nhttps://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.6.0\n","enisa_id":"EUVD-2026-36286\n","aliases":"CVE-2026-46519\nGHSA-cr22-wjx7-2w6m\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"39573f36-e569-3666-ad56-bed51da27c05","advisory":{"id":"openSUSE-SU-2026:10914-1","description":"atril-1.28.4-1.1 on GA media","summary":"atril-1.28.4-1.1 on GA media","datePublished":"May 31, 2026, 12:00:00 AM","dateUpdated":"Sep 19, 2026, 8:19:16 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10914-1.json\nhttps://www.suse.com/security/cve/CVE-2026-46519/\n","aliases":"CVE-2026-46519\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"07f6e9b0-5c0b-34c0-a828-1820af48c6d7","product":{"name":"atril-lang-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"10a25ac8-72e9-341c-8f96-1a26325842e7","product":{"name":"atril-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"10e13ba8-c8d9-34df-94a4-fe6e078db62f","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"204e98e5-2c87-350b-a978-ec84517218a4","product":{"name":"libatrilview3-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"20c19956-8b22-37ee-a3c8-e8a98c02c9bf","product":{"name":"atril-thumbnailer-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2f6cb026-862a-3032-a24d-aebf90e47efc","product":{"name":"atril-doc-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"371e9de1-a569-3adb-be08-e27ec0ebc3b7","product":{"name":"libatrildocument3-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"386d4a2f-ee69-3de9-9748-25eec4871082","product":{"name":"atril-devel-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3cec0761-c92a-3aaa-aa14-397fb620aa0d","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"457202ce-1d97-3c92-943d-cb8a16880a5f","product":{"name":"atril-doc-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"47ae2094-3885-3b2b-93c8-ead3d2867cd8","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"49a6c06b-11fe-3586-95d3-a83ea9960fa0","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4ea99c2e-c7cd-33fa-918f-c93b8302b5a6","product":{"name":"atril-backends-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5bbe755f-c490-38c8-bef1-312685059715","product":{"name":"atril-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"5c23b791-6824-38d1-95b6-b4d3c48d8407","product":{"name":"libatrildocument3-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6902c9cd-0176-374b-9ce3-88fefc791ff6","product":{"name":"caja-extension-atril-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6ba85453-c5c8-3044-9a7b-06a3567fa10e","product":{"name":"atril-devel-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6d8cee41-a9d2-31e2-bade-ad60672cb5a1","product":{"name":"caja-extension-atril-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"7815e59b-6a71-3e53-8e8f-d807f7b02bed","product":{"name":"atril-lang-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7a5e7e59-131b-309e-97f2-86bd3bb41be3","product":{"name":"atril-thumbnailer-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7ca146db-4539-3329-8462-a805370514d2","product":{"name":"atril-devel-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7d366de0-0c68-302f-a9a7-44e1bceff7db","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7edadb7e-b68b-3308-91d6-b70b4e165f53","product":{"name":"caja-extension-atril-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"85cd9853-9a27-3c17-a910-a7c7a6b6aea5","product":{"name":"libatrilview3-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"883ace7a-dcf6-3cac-b456-2d23bacd7768","product":{"name":"atril-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"995c9e58-0c79-3b16-b115-450cd9c41944","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ab974b2e-6b4c-3157-aabc-0147723bf09c","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"adc0b096-9e9c-3222-9b04-8ae76c07ed0d","product":{"name":"atril-lang-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"aef20347-bd79-30e4-8755-570e78c30c9d","product":{"name":"caja-extension-atril-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"afe364bb-be6a-3ffa-bdf4-e6970043cdc5","product":{"name":"atril-thumbnailer-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b16bbbc1-e676-3c34-99e1-e71afb555dfd","product":{"name":"atril-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b5ece199-c465-3f37-b01d-4d5e9e5926cc","product":{"name":"atril-lang-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b9135476-4ae8-38f4-bd8a-87e77935f2b3","product":{"name":"libatrilview3-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"be668ced-3210-390e-ac45-fea5bda1f2b0","product":{"name":"atril-devel-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c34e7127-3edd-3015-add0-3105bad15bcc","product":{"name":"libatrildocument3-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"cba9a2d9-0620-36f4-9a50-20013ae4be0a","product":{"name":"libatrilview3-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cbfc629d-4502-3673-b29a-32bf61626b40","product":{"name":"libatrildocument3-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d3f92cfd-826b-360a-b87a-8f412cea5162","product":{"name":"atril-backends-0:1.28.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d9dfca0d-fe3a-39ff-a450-6d11c2cf7b74","product":{"name":"atril-backends-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"db52eec2-23d5-305c-b18a-64ac803787f8","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"de28012a-727a-3435-944b-e3af902844e6","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"e3a27dba-024d-3899-9d1c-6f35eeb753da","product":{"name":"atril-backends-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e81bb75c-dff8-3198-a46b-f3a8bbbc8502","product":{"name":"atril-doc-0:1.28.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"efdbeb73-0977-3fe2-b3b9-375df88a70c9","product":{"name":"atril-thumbnailer-0:1.28.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fcae0ccd-476e-3da6-b905-a73fc7e953a9","product":{"name":"atril-doc-0:1.28.4-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"ff7d6033-f7bc-3e58-a1ce-ba196ea24ce5","advisory":{"id":"openSUSE-SU-2026:21152-1","description":"Security update for atril","summary":"Security update for atril","datePublished":"Jun 23, 2026, 1:25:31 PM","dateUpdated":"Sep 17, 2026, 5:37:00 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21152-1.json\nhttps://bugzilla.suse.com/1265880\nhttps://www.suse.com/security/cve/CVE-2026-46519/\n","aliases":"CVE-2026-46519\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"011a76ff-00fc-3704-a104-324379b9981d","product":{"name":"atril-lang-0:1.28.4-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"07052816-c9d7-3551-8b40-f05c6b219c6e","product":{"name":"libatrildocument3-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"0c3a7265-2dcd-323e-a4f1-03bc5f4d68c7","product":{"name":"atril-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"130f9daf-6e8e-3553-a2e4-accc2e174cb3","product":{"name":"atril-devel-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"15cee28c-324f-32f7-9f10-a9b91e860021","product":{"name":"atril-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"2103c714-86b5-3a63-9a85-4fc5262bc049","product":{"name":"libatrildocument3-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"247ad5bf-5e7b-370e-b205-368346255d16","product":{"name":"atril-backends-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"24f467fb-1ad6-3d2e-bac1-9c6f5a742c16","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"296bd5d7-52d1-3ccc-a955-e5971f500b9f","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"2d075347-804b-3620-95c5-192199992fdf","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"36f51c38-1da6-31d1-a232-edb5236d73b3","product":{"name":"libatrilview3-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3b538949-14b6-37ee-978b-09b64030a1e9","product":{"name":"atril-thumbnailer-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3cd26b6d-c693-39b5-a70f-30583af90150","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"405e1b7f-6734-3f20-987c-1312ed1988a0","product":{"name":"atril-thumbnailer-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"430f529d-8abd-348b-a43a-fa2b821b3195","product":{"name":"atril-doc-0:1.28.4-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"45696085-e321-3478-951e-0d0010b37bb6","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4b36d6ee-9fac-31d3-b70a-ac6a774523dc","product":{"name":"libatrildocument3-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"54629a0d-1e7a-3d13-940a-3ffb37ee6054","product":{"name":"caja-extension-atril-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"554e6b81-47f9-34e6-b95d-9e358881d3e5","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"59b4bf5e-d40a-387e-b500-ef72c0b9f0f4","product":{"name":"libatrilview3-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"642e9495-772c-3329-9153-82c9f1bb86e5","product":{"name":"caja-extension-atril-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6c1366e5-5919-3040-9988-20b0d860f8ca","product":{"name":"atril-backends-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6ea4f9c7-ebf1-352d-9388-a4a5f955e17e","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"747719f9-38c9-337c-888b-1cf32f49824b","product":{"name":"atril-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7b242e79-059f-3ead-a4fd-ac38408c0e94","product":{"name":"caja-extension-atril-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7d673258-c80a-3310-94b6-df82de9133ed","product":{"name":"atril-backends-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7f7cd35b-e3c1-3517-b16e-6bc4b9f19dc1","product":{"name":"atril-thumbnailer-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7f9429f0-9554-3375-be44-6ee24e8666cb","product":{"name":"atril-thumbnailer-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"7fc83f3e-e094-3b40-8a8e-37f3a0ac7f6a","product":{"name":"atril-devel-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"84666b97-1953-3a59-a031-82881fb4606d","product":{"name":"typelib-1_0-AtrilDocument-1_5_0-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8c2002fa-a4a5-372e-a194-09a7bc4d3cd3","product":{"name":"atril-devel-0:1.28.4-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a583056e-5512-33a6-8b26-bbf13255ad6f","product":{"name":"libatrildocument3-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a63c869f-ab63-3706-b88d-c38614f9d7aa","product":{"name":"atril-backends-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"bcf6c286-6ddf-32bf-a7a5-f2c6b117482d","product":{"name":"atril-devel-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"cb1bc592-9263-3ec0-9511-d82a549b045d","product":{"name":"libatrilview3-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"e103b8a2-55a7-3caa-bdff-9f320814528a","product":{"name":"caja-extension-atril-0:1.28.4-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"eba57b3f-6861-3130-8b02-0b23c864f899","product":{"name":"libatrilview3-0:1.28.4-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f7977f16-194f-325d-801b-7f480c28dbe9","product":{"name":"atril-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ff5ad826-ef9f-324b-82dc-e08a7aebcf08","product":{"name":"typelib-1_0-AtrilView-1_5_0-0:1.28.4-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}