mcp-server-kubernetes 3.8.x - Argument Injection

ExploitDBExploitDB exploitExploitEDB-52638

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends a crafted JSON-RPC request to an MCP Server Kubernetes endpoint, injecting the --server flag via the resourceType parameter to redirect kubectl commands to an attacker-controlled API server, thereby exfiltrating the operator's bearer token.

Backdoor review

No backdoor observed in reviewed code

The PoC script sends a crafted JSON-RPC request to exploit CVE-2026-61459 by injecting a --server flag into the resourceType parameter. It requires the operator to supply both a target MCP server and an attacker-controlled server URL. The script only makes a single HTTP POST to the target; it does not connect to the attacker server, exfiltrate data, establish persistence, or execute any unrelated payload. No concealed or deceptive behavior was found.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwaremcp-server-kubernetes
Attack typesargument injectioncredential exfiltration
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a payload designed to inject arguments into a server-side command, causing the server to connect to an attacker-controlled host and leak credentials. This constitutes exploitation, not mere detection or scanning.

exploits/multiple/remote/52638.py:68-82exploits/multiple/remote/52638.py:88-100

Requirements

  • Requires network access to the MCP Server JSON-RPC endpoint.exploits/multiple/remote/52638.py:62
  • Requires an attacker-controlled Kubernetes API server to receive the exfiltrated token.exploits/multiple/remote/52638.py:63

Observed behavior

  • Constructs a JSON-RPC tools/call request with a malicious resourceType value containing --server=<attacker_url>.exploits/multiple/remote/52638.py:69-82
  • Sends the crafted request to the target MCP server via HTTP POST.exploits/multiple/remote/52638.py:89-94
  • Reports success based on HTTP response status and instructs the user to check a listener for the exfiltrated bearer token.exploits/multiple/remote/52638.py:96-100
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
HTTP POST to user-supplied --target URLThe script sends the exploit payload to the target MCP server. It does not connect to the attacker server.exploits/multiple/remote/52638.py:89-94
Payload
resourceType parameter set to --server=<attacker_url>This is the argument injection payload that exploits the vulnerability. It is the core of the PoC and is expected behavior.exploits/multiple/remote/52638.py:75
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the static content of the provided Python script; no external dependencies (e.g., requests library) were resolved, and the code was not executed.
  • The script's effectiveness depends on the target server's configuration and the presence of a listener on the attacker's machine, which are not verified by the evidence.
  • Only the supplied text file was reviewed; no external dependencies (e.g., the requests library) were inspected.
  • The review does not assess whether the target MCP server is actually vulnerable or whether the exploit works as claimed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1