GHSA-cr22-wjx7-2w6m: MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

Summary

The mcp-server-kubernetes package exposes ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS and ALLOWED_TOOLS as access controls, but they are enforced only at tools/list and not at tools/call. Any client that knows a tool name can invoke it directly, so kubectl_delete, exec_in_pod, kubectl_generic and node_management run regardless of the configured restriction, which the advisory says is equivalent to full cluster compromise when the service account has cluster-admin.

Mitigation

Fixed in v3.6.0. The fix applies the same filtering logic from ListToolsRequestSchema at the start of the CallToolRequestSchema handler, returning an error for any tool call outside the active allowed set.

Topics

• Model Context Protocol

Related items

• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek
• MediumMalicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' ComputersSimilar attack · The Hacker News
• LowRailway’s AI agents go off the track on a rival’s networkSimilar attack · CSO Online
• MediumOpenAI Model Wrote Its Own Network Code to Get Around Sandbox RestrictionsSimilar attack · SecurityWeek
• MediumChainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key ServicesSimilar attack · The Hacker News