feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355.
References
| Link | Resource |
|---|---|
| https://github.com/feiskyer/mcp-kubernetes-server/blob/78957b6c1a3982080cf6fcaac6f6e9014116a71c/src/mcp_kubernetes_server/command.py#L38 | Product |
| https://github.com/william31212/CVE-Requests-1896609 | Third Party Advisory |
| https://github.com/william31212/CVE-Requests-1896609 | Third Party Advisory |
Configurations
History
20 Sep 2025, 02:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:feisky:mcp-kubernetes-server:*:*:*:*:*:*:*:* | |
| First Time |
Feisky mcp-kubernetes-server
Feisky |
|
| References | () https://github.com/feiskyer/mcp-kubernetes-server/blob/78957b6c1a3982080cf6fcaac6f6e9014116a71c/src/mcp_kubernetes_server/command.py#L38 - Product | |
| References | () https://github.com/william31212/CVE-Requests-1896609 - Third Party Advisory |
15 Sep 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/william31212/CVE-Requests-1896609 - |
15 Sep 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-15 14:15
Updated : 2025-09-20 02:50
NVD link : CVE-2025-59377
Mitre link : CVE-2025-59377
CVE.ORG link : CVE-2025-59377
JSON object : View
Products Affected
feisky
- mcp-kubernetes-server
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')