mcp-server-kubernetes: port_forward builds a kubectl command by string splitting, allowing flag injection

Impact

Unlike every other tool in this MCP server, port_forward concatenates user input into a kubectl command string and splits it on spaces before spawn(), so any space in namespace, resourceType, resourceName, localPort or targetPort becomes an argument boundary and arbitrary kubectl flags can be injected. Injecting --address=0.0.0.0 publishes an internal service to the network, and extra -n flags reach namespaces the caller was not scoped to. Because this server is driven by an LLM agent, the injection can arrive indirectly through prompt injection in content the agent reads, which means a cluster operator's agent session is enough to expose a GPU tenant's internal service or pivot across namespaces without anyone issuing the command deliberately. Affects 3.4.0 and earlier; fixed in 3.5.0.

Who can reach it

Anyone who can influence the arguments the agent passes to port_forward - a user of the MCP server, or any content the connected agent processes if it is subject to prompt injection. The server acts with whatever kubeconfig credentials it was given.

What to do

Upgrade mcp-server-kubernetes to 3.5.0 and restart the MCP server process - a daemon restart only. Scope the kubeconfig the server runs with to the narrowest RBAC that still works rather than a cluster-admin context, and do not expose agent-driven port-forwards on cluster-reachable addresses.

References

Related entries

• Contour: HTTPProxy cookie rewrite policy injects Lua that runs inside the shared Envoy proxyCVE-2026-41246 · Contour ingress controller (cookie rewriting via Envoy HTTP Lua filter)High
• Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path): The first fix forCVE-2026-42296 · Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path)High
• etcd: revoked client certificates still authenticate on the gRPC listener when HTTP and gRPC are splitCVE-2026-59818 · etcd (gRPC client listener with --listen-client-http-urls, --client-crl-file enforcement)High
• containerd: On SELinux hosts, an unprivileged pod with a hostPath volume can gain full read/write to the host filesystemCVE-2021-43816 · containerdHigh
• Cilium: IPsec transparent encryption is cryptographically ineffectiveCVE-2024-28860 · CiliumHigh
• CRI-O: untrusted checkpoint archive on restore allows unintended host filesystem operationsCVE-2026-15801 · CRI-O (container checkpoint/restore metadata validation)High