mcp-server-kubernetes

npm · v4.1.0 · 19,498 dl/week · 409 packages installed

MCP server for interacting with Kubernetes clusters via kubectl

Installing this server brings 409 third-party packages inside your agent's trust boundary (12 direct). This is attack surface, not a vulnerability count — it does not affect the grade above.

1 package in this tree runs a script at install time.

Findings (5)

HIGH VULN_KNOWN — GHSA-4xqg-gf5c-ghwq: MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting. See https://osv.dev/vulnerability/GHSA-4xqg-gf5c-ghwq
MED VULN_KNOWN — GHSA-6mx4-4h42-r8vh: MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration. See https://osv.dev/vulnerability/GHSA-6mx4-4h42-r8vh
HIGH VULN_KNOWN — GHSA-cr22-wjx7-2w6m: MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement. See https://osv.dev/vulnerability/GHSA-cr22-wjx7-2w6m
HIGH VULN_KNOWN — GHSA-gjv4-ghm7-q58q: MCP Server Kubernetes vulnerable to command injection in several tools. See https://osv.dev/vulnerability/GHSA-gjv4-ghm7-q58q
MED VULN_KNOWN — GHSA-wvxp-jp4w-w8wg: mcp-server-kubernetes has potential security issue in exec_in_pod tool. See https://osv.dev/vulnerability/GHSA-wvxp-jp4w-w8wg

Embed this badge

[![MCP security](https://vulnrable.com/api/mcpbadge?pkg=mcp-server-kubernetes&eco=npm)](https://vulnrable.com/mcp/mcp-server-kubernetes/)

Source repo Registry page Check your own config →

Automated registry-metadata scan; not a code audit. Rescanned on each site deploy.