{"data":{"id":"9f57880c-36cd-4468-85ee-e28ffb373164","title":"GHSA-cr22-wjx7-2w6m: MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement","summary":"The mcp-server-kubernetes package exposes ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS and ALLOWED_TOOLS as access controls, but they are enforced only at tools/list and not at tools/call. Any client that knows a tool name can invoke it directly, so kubectl_delete, exec_in_pod, kubectl_generic and node_management run regardless of the configured restriction, which the advisory says is equivalent to full cluster compromise when the service account has cluster-admin.","solution":"Fixed in v3.6.0. The fix applies the same filtering logic from ListToolsRequestSchema at the start of the CallToolRequestSchema handler, returning an error for any tool call outside the active allowed set.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-cr22-wjx7-2w6m","publishedAt":"2026-05-21T20:33:46.000Z","cveId":"CVE-2026-46519","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mcp-server-kubernetes@< 3.6.0 (fixed: 3.6.0)"],"affectedPackageNames":["mcp-server-kubernetes"],"affectedPackageRefs":["npm:mcp-server-kubernetes"],"affectedVendors":[],"affectedVendorsRaw":["mcp-server-kubernetes","MCP","Codex CLI","Gemini CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00513,"epssCheckedAt":"2026-11-06T12:09:44.559Z","kevDateAdded":null,"advisoryAliases":["GHSA-cr22-wjx7-2w6m"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-21T20:33:46.000Z","fixReleasedAt":"2026-05-14T17:54:59.316Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:35:33.405Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"mcp-server-kubernetes","fixedVersion":"3.6.0","matchedVersion":"3.6.0","fixReleasedAt":"2026-05-14T17:54:59.316Z","daysToFix":-7,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:35:33.259Z"}]}}