# mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)

- **Severity:** High
- **Signature ID:** `e1d98abc-ae65-46b1-af2c-7b9d25cdf848`
- **CVEs:** CVE-2025-53355
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

A widely used Kubernetes automation tool for AI agents (mcp-server-kubernetes) fails to sanitize inputs before running them as shell commands. An attacker who can influence the parameters sent to certain tools can run arbitrary commands on the server, inheriting its Kubernetes admin access.

## How the attack works

The mcp-server-kubernetes package exposes tools like kubectl_scale, kubectl_patch, and explain_resource to AI agents. These tools build shell commands from tool parameters and execute them with execSync without stripping shell metacharacters such as ; | && $() or backticks. If an attacker can control or inject into those parameters — for example through a manipulated prompt, a compromised upstream data source, or a malicious tool response in a multi-agent chain — they can append their own shell commands. Those commands run with whatever Kubernetes credentials the MCP server holds, which are often cluster-admin level.

## Why it matters

Successful exploitation gives an attacker arbitrary command execution on the host running the MCP server, with the server's Kubernetes admin privileges — enabling full cluster compromise, data exfiltration, or lateral movement.

## What you can do

- Upgrade mcp-server-kubernetes past version 2.4.9 where this is fixed.
- Until patched, disable or restrict access to kubectl_scale, kubectl_patch, and explain_resource tools.
- Run the MCP server with the least-privileged Kubernetes credentials possible, not cluster-admin.
- Review any logs or sessions where these tools received unusual arguments containing shell metacharacters (; | && $() or backticks).

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01927
- https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q
- https://nvd.nist.gov/vuln/detail/CVE-2025-53355

---
Source: https://www.netzilo.com/threats/atr-mcp-server-kubernetes-command-injection-in-kubectl-scale-kub