GHSA-wmg3-h8mf-wgvrPublished
MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-61459 · Microsoft / collected KEV context
cve-program · CVE-2026-61459
- https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0
- https://github.com/Flux159/mcp-server-kubernetes/issues/328
- https://github.com/Flux159/mcp-server-kubernetes/pull/329
- https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
- https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools
euvd · EUVD-2026-42987
- https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0
- https://github.com/Flux159/mcp-server-kubernetes/issues/328
- https://github.com/Flux159/mcp-server-kubernetes/pull/329
- https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
- https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools
nvd · CVE-2026-61459
- https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
- https://github.com/Flux159/mcp-server-kubernetes/issues/328
- https://github.com/Flux159/mcp-server-kubernetes/pull/329
- https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0
- https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools
osv · GHSA-wmg3-h8mf-wgvr
- https://nvd.nist.gov/vuln/detail/CVE-2026-61459
- https://github.com/Flux159/mcp-server-kubernetes/issues/328
- https://github.com/Flux159/mcp-server-kubernetes/pull/329
- https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
- https://github.com/Flux159/mcp-server-kubernetes
- https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0
- https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools
Related operational evidence
Explicit CVE identifiers- mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials · Newly collected advisory · 28 Oct 2026