CVE-2026-39884
Published: 15 April 2026
Summary
CVE-2026-39884 is a high-severity Argument Injection (CWE-88) vulnerability in Suyogs Mcp-Server-Kubernetes. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-39884 is an argument injection vulnerability affecting mcp-server-kubernetes, a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior are vulnerable in the port_forward tool located at src/tools/port_forward.ts, where a kubectl command is constructed through string concatenation with user-controlled input from fields such as namespace, resourceType, resourceName, localPort, and targetPort. This input is then split on spaces before being passed to spawn(), unlike other tools in the codebase that properly use array-based argument passing with execFileSync(). The flaw, classified under CWE-88, carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
An attacker with low privileges (PR:L) can exploit this over the network with low complexity by injecting arbitrary kubectl flags through spaces in the controlled fields. This allows exposure of internal Kubernetes services to the network via flags like --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation through prompt injection against AI agents connected to the MCP server.
The issue has been addressed in version 3.5.0, as detailed in the project's GitHub release notes and security advisory GHSA-4xqg-gf5c-ghwq, which recommend upgrading to the patched version for mitigation.
Notably, the vulnerability has relevance to AI/ML environments due to its potential for prompt injection attacks targeting AI agents interacting with the MCP server, though no real-world exploitation has been reported.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22807
Vulnerability details
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then…
more
naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp, model context protocol, prompt injection
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Argument injection into kubectl command construction via string concatenation and space splitting directly enables remote exploitation of the public-facing MCP server (T1190) and Unix shell command execution through injected arguments (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents argument injection by requiring validation of user-controlled inputs (namespace, resourceType, resourceName, ports) before constructing and executing kubectl commands.
Ensures timely patching of the specific flaw in port_forward.ts fixed in version 3.5.0, eliminating the vulnerable string concatenation and spawn() usage.
Limits damage from injected kubectl flags (e.g., service exposure or cross-namespace attacks) by enforcing least privilege on low-privileged (PR:L) accounts running the mcp-server.