CVE-2026-61459Critical· 9.8▾ AbyssalPoC availableMCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying re…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
Exploit-DB
0.5% → 2.4%
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
mcp-server-kubernetes < 3.9.0Upgrade past the affected range:
mcp-server-kubernetes 3.9.0Affected packages:
mcp-server-kubernetes < 3.9.0Patched in:
mcp-server-kubernetes 3.9.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59937Critical· 9.1go-mail is a comprehensive library for sending mails with Go
CVE-2026-102827High· 8.1simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
CVE-2026-119282High@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
CVE-2026-112944Medium· 6.3launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112900Critical· 9.2Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-104715High· 7.8Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass