MediumVulnerability
CVE-2025-66404: MCP Server Kubernetes command injection in exec_in_pod tool
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-66404
- Published
- Record updated
- Affected
- mcp-server-kubernetes <= 2.9.7
- Fixed in
- 2.9.8
- released November 30, 2025, 2 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.5%
Summary
CVE-2025-66404 affects the exec_in_pod tool in mcp-server-kubernetes, an MCP Server that connects to and manages Kubernetes clusters, in versions prior to 2.9.8. When the tool receives a command as a string, it is passed directly to sh -c without input validation, so shell metacharacters are interpreted. Exploitation can occur through direct command injection or through indirect prompt injection, where AI agents may run commands without explicit user intent.
Mitigation
Fixed in 2.9.8.
Topics
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database