CVE-2026-46519

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.6.0
https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m
https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) mcp-server-kubernetes es un servidor de Protocolo de Contexto de Modelo para la gestión de clústeres de Kubernetes. Antes de la versión 3.6.0, mcp-server-kubernetes expone tres variables de entorno (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documentadas como controles de acceso para restringir qué operaciones de Kubernetes están disponibles. Estos controles se aplican en la capa de descubrimiento de herramientas (tools/list) pero no en la capa de ejecución (tools/call). Cualquier cliente que conozca el nombre de una herramienta puede invocarla directamente independientemente del modo de restricción configurado. El control de acceso era efectivamente cosmético. Este problema ha sido parcheado en la versión 3.6.0.

Information

Published : 2026-06-11 19:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-46519

Mitre link : CVE-2026-46519

CVE.ORG link : CVE-2026-46519

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-46519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46519", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T19:39:57.663035Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Flux159", "product": "mcp-server-kubernetes", "versions": [{"status": "affected", "version": "< 3.6.0"}]}]}], "published": "2026-06-11T19:16:42.213", "references": [{"url": "https://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.6.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m", "source": "security-advisories@github.com"}, {"url": "https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0."}, {"lang": "es", "value": "mcp-server-kubernetes es un servidor de Protocolo de Contexto de Modelo para la gesti\u00f3n de cl\u00fasteres de Kubernetes. Antes de la versi\u00f3n 3.6.0, mcp-server-kubernetes expone tres variables de entorno (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documentadas como controles de acceso para restringir qu\u00e9 operaciones de Kubernetes est\u00e1n disponibles. Estos controles se aplican en la capa de descubrimiento de herramientas (tools/list) pero no en la capa de ejecuci\u00f3n (tools/call). Cualquier cliente que conozca el nombre de una herramienta puede invocarla directamente independientemente del modo de restricci\u00f3n configurado. El control de acceso era efectivamente cosm\u00e9tico. Este problema ha sido parcheado en la versi\u00f3n 3.6.0."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}