CVE-2025-69902
A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Deferred - cve@mitre.org
- Published
- 2026-03-16
- Last modified
- 2026-03-17
- Weaknesses
- CWE-94
References
- https://asec.ahnlab.com/ko/92922/
- https://github.com/rohitg00/kubectl-mcp-server
- https://github.com/rohitg00/kubectl-mcp-server/blob/main/kubectl_mcp_tool/minimal_wrapper.py
- https://pypi.org/project/kubectl-mcp-tool
