CVE-2025-66404

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

Summary

A security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent.

Details

The MCP Server exposes the exec_in_pod tool to execute commands inside Kubernetes pods. The tool supports both array and string command formats. The Kubernetes Exec API (via @kubernetes/client-node) accepts commands as an array of strings, which executes commands directly without shell interpretation. However, when a string format is provided, the code automatically wraps it in shell execution (sh -c), which interprets shell metacharacters without any input validation.

When string commands contain shell metacharacters (e.g., ;, &&, |, >, <, $), they are interpreted by the shell rather than being passed as literal arguments, allowing command injection. This vulnerability can be exploited in two ways:

1. Direct command injection: Users or attackers with access to the MCP server can directly inject malicious commands through the tool interface.
2. Indirect prompt injection: Malicious instructions embedded in data (e.g., pod logs) can trick AI agents into executing commands without explicit user intent.

Code pattern

The following snippet illustrates the code pattern used in the exec_in_pod tool:

File: src/tools/exec_in_pod.ts

export async function execInPod(
  k8sManager: KubernetesManager,
  input: {
    name: string;
    namespace?: string;
    command: string | string[];  // User-controlled input
    container?: string;
    shell?: string;
    timeout?: number;
    context?: string;
  }
): Promise<{ content: { type: string; text: string }[] }> {
  const namespace = input.namespace || "default";
  let commandArr: string[];
  
  if (Array.isArray(input.command)) {
    commandArr = input.command;
  } else {
    // User input passed to shell
    const shell = input.shell || "/bin/sh";
    commandArr = [shell, "-c", input.command];  // Shell metacharacters are interpreted
  }

  // ... Kubernetes Exec API call ...
  exec.exec(
    namespace,
    input.name,
    input.container ?? "",
    commandArr,  // Executed inside pod via shell
    stdoutStream,
    stderrStream,
    stdinStream,
    true,
    callback
  );
}

When input.command is a string, the code automatically wraps it in a shell command (/bin/sh -c), which interprets shell metacharacters. There is no input validation to detect or block shell metacharacters, allowing arbitrary command execution through command chaining (e.g., id>/tmp/TEST && echo done).

PoC

Direct command injection via MCP Inspector

This demonstrates command injection through direct tool invocation:

1. Start a Kubernetes cluster (e.g., using minikube):

   minikube start
   

2. Create a test pod:

   kubectl run test-pod --image=busybox --command -- sleep 3600
   

3. Open the MCP Inspector:

   npx @modelcontextprotocol/inspector
   

4. In MCP Inspector:

   • Set transport type: STDIO
   • Set the command to npx
   • Set the arguments to -y mcp-server-kubernetes --stdio
   • Click Connect
   • Go to the Tools tab and click List Tools
   • Select the exec_in_pod tool

5. Verify the file /tmp/TEST does NOT exist before execution:

   kubectl exec test-pod -n default -- cat /tmp/TEST
   cat: /tmp/TEST: No such file or directory
   

6. In MCP Inspector, fill in the fields:

   • Name field: test-pod
   • Namespace field: default
   • Command field: "id>/tmp/TEST && echo done" (include quotes) …

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

Summary

A security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent.

Details

The MCP Server exposes the exec_in_pod tool to execute commands inside Kubernetes pods. The tool supports both array and string command formats. The Kubernetes Exec API (via @kubernetes/client-node) accepts commands as an array of strings, which executes commands directly without shell interpretation. However, when a string format is provided, the code automatically wraps it in shell execution (sh -c), which interprets shell metacharacters without any input validation.

When string commands contain shell metacharacters (e.g., ;, &&, |, >, <, $), they are interpreted by the shell rather than being passed as literal arguments, allowing command injection. This vulnerability can be exploited in two ways:

1. Direct command injection: Users or attackers with access to the MCP server can directly inject malicious commands through the tool interface.
2. Indirect prompt injection: Malicious instructions embedded in data (e.g., pod logs) can trick AI agents into executing commands without explicit user intent.

Code pattern

The following snippet illustrates the code pattern used in the exec_in_pod tool:

File: src/tools/exec_in_pod.ts

export async function execInPod(
  k8sManager: KubernetesManager,
  input: {
    name: string;
    namespace?: string;
    command: string | string[];  // User-controlled input
    container?: string;
    shell?: string;
    timeout?: number;
    context?: string;
  }
): Promise<{ content: { type: string; text: string }[] }> {
  const namespace = input.namespace || "default";
  let commandArr: string[];
  
  if (Array.isArray(input.command)) {
    commandArr = input.command;
  } else {
    // User input passed to shell
    const shell = input.shell || "/bin/sh";
    commandArr = [shell, "-c", input.command];  // Shell metacharacters are interpreted
  }

  // ... Kubernetes Exec API call ...
  exec.exec(
    namespace,
    input.name,
    input.container ?? "",
    commandArr,  // Executed inside pod via shell
    stdoutStream,
    stderrStream,
    stdinStream,
    true,
    callback
  );
}

When input.command is a string, the code automatically wraps it in a shell command (/bin/sh -c), which interprets shell metacharacters. There is no input validation to detect or block shell metacharacters, allowing arbitrary command execution through command chaining (e.g., id>/tmp/TEST && echo done).

PoC

Direct command injection via MCP Inspector

This demonstrates command injection through direct tool invocation:

1. Start a Kubernetes cluster (e.g., using minikube):

   minikube start
   

2. Create a test pod:

   kubectl run test-pod --image=busybox --command -- sleep 3600
   

3. Open the MCP Inspector:

   npx @modelcontextprotocol/inspector
   

4. In MCP Inspector:

   • Set transport type: STDIO
   • Set the command to npx
   • Set the arguments to -y mcp-server-kubernetes --stdio
   • Click Connect
   • Go to the Tools tab and click List Tools
   • Select the exec_in_pod tool

5. Verify the file /tmp/TEST does NOT exist before execution:

   kubectl exec test-pod -n default -- cat /tmp/TEST
   cat: /tmp/TEST: No such file or directory
   

6. In MCP Inspector, fill in the fields:

   • Name field: test-pod
   • Namespace field: default
   • Command field: "id>/tmp/TEST && echo done" (include quotes) …