mcp-server-kubernetes: read-only and allowed-tool restrictions are not enforced at tool execution

Impact

The three environment variables operators use to run this MCP server in a read-only or non-destructive mode only filtered the tools/list response; tools/call executed anything a client named. Any LLM agent or user wired to a server believed to be read-only could delete workloads, drain nodes, read secrets, or otherwise exercise the full kubeconfig the server holds. On a GPU cluster that typically means the service account that schedules and evicts GPU pods, so a prompt-injected or careless agent can destroy running training jobs and queue state. The guardrail was cosmetic, so any audit that relied on it was wrong.

Who can reach it

Any client that can reach the MCP server endpoint and knows a tool name. No separate authentication beyond whatever fronts the MCP server; the server's own restriction mode provides none.

What to do

Upgrade mcp-server-kubernetes to 3.6.0 or later and restart the server process. Until then treat the server's kubeconfig as fully privileged and restrict it with RBAC on the Kubernetes side rather than the env vars; review audit logs for tool calls outside the intended mode.

References

Related entries

• Argo CD repo-server: shell metacharacters in a repository proxy URL run commands and leak Git/Helm/OCI credentialsCVE-2026-55797 · Argo CD repo-server (SSH repository proxy ProxyCommand)High
• Rancher: plaintext non-expiring registration tokens let an attacker join a rogue node to a clusterCVE-2026-55997 · Rancher (downstream cluster registration tokens)High
• Tetragon: unauthenticated gRPC API on localhost lets a same-node pod rewrite tracing policyCVE-2026-65960 · Cilium Tetragon (Helm default gRPC TCP listener on localhost:54321)High
• Portainer CE: non-canonical URL path defeats Docker proxy authorization, granting root on the Docker hostCVE-2026-72533 · Portainer CE (Docker API proxy authorization middleware)High
• Dokploy: WebSocket handlers skip per-server authorization, giving any org member root terminalsCVE-2026-72883 · Dokploy (WebSocket terminal, container-terminal, logs and stats handlers)High
• OpenChoreo: workflow parameters interpolated into sh -c run as commands in privileged build podsCVE-2026-73667 · OpenChoreo Workflow Plane (sample workflow templates, sh -c parameter interpolation)High