CVE-2026-39884
Suyogs Mcp-Server-Kubernetes ≤ 3.5.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2026-39884 is a high-severity Argument Injection (CWE-88) vulnerability in Suyogs Mcp-Server-Kubernetes. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39884 is an argument injection vulnerability affecting mcp-server-kubernetes, a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior are vulnerable in the port_forward tool located at src/tools/port_forward.ts, where a kubectl command is constructed through string concatenation with user-controlled input from fields such as namespace, resourceType, resourceName, localPort, and targetPort. This input is then split on spaces before being passed to spawn(), unlike other tools in the codebase that properly use array-based argument passing with execFileSync(). The flaw, classified under CWE-88, carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
An attacker with low privileges (PR:L) can exploit this over the network with low complexity by injecting arbitrary kubectl flags through spaces in the controlled fields. This allows exposure of internal Kubernetes services to the network via flags like --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation through prompt injection against AI agents connected to the MCP server.
The issue has been addressed in version 3.5.0, as detailed in the project's GitHub release notes and security advisory GHSA-4xqg-gf5c-ghwq, which recommend upgrading to the patched version for mitigation.
Notably, the vulnerability has relevance to AI/ML environments due to its potential for prompt injection attacks targeting AI agents interacting with the MCP server, though no real-world exploitation has been reported.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22807
Vulnerability Data
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then…
more
naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp, model context protocol, prompt injection
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can discover argument-injection flaws in command-construction code but does not stop their introduction.
Input validation directly stops construction of command strings containing unneutralized delimiters or injected arguments.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and command construction to prevent argument injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect argument injection but does not prevent it at the source.
Secure development lifecycle mandates input validation and command construction practices that directly prevent argument injection.
Application security requirements include explicit rules for safe command-line argument handling and escaping.
Secure architecture principles discourage unsafe command invocation patterns and favor safer APIs.
Secure coding standards explicitly require proper neutralization of command arguments, directly eliminating CWE-88.
Change management can catch unsafe command patterns during reviews but is not a direct mitigation.