MCP Server Kubernetes kubectl_generic Flag Injection Bearer Token Exfiltration (CVE-2026-47250)
A vulnerability in mcp-server-kubernetes (CVE-2026-47250) lets an attacker steal an operator's Kubernetes access token by planting hidden instructions where an AI agent will read them, such as pod logs. The agent then runs a kubectl command that redirects traffic to an attacker's server and disables certificate checking, causing the operator's bearer token to be sent straight to the attacker.
How the attack works
An attacker plants a crafted instruction (for example, inside pod log text) that an AI agent later reads while doing routine operations. The injected instruction manipulates the agent into calling the kubectl_generic tool with two flags at once: --server pointing to an attacker-controlled URL, and --insecure-skip-tls-verify set to true. Because TLS verification is off, kubectl sends the Authorization Bearer token to the attacker's endpoint instead of refusing to send it, as it would over an unverified plain connection. The attacker then replays that stolen token against the real Kubernetes API server, gaining the operator's full RBAC permissions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 162cd10b-e2f1-4d56-b5ad-f2842c58ad2e
- Severity
- High
- CVEs
- CVE-2026-47250
Why it matters
An attacker can silently capture a Kubernetes operator's access credentials and reuse them to act with that operator's full cluster permissions, potentially reading, modifying, or deleting workloads and secrets across the cluster.
What you can do
- →Upgrade mcp-server-kubernetes to v3.7.0 or later, which is expected to fix the missing flag allowlist.
- →Restrict or review any agent's ability to pass raw --server or --insecure-skip-tls-verify flags to kubectl; consider blocking these flags entirely unless explicitly needed.
- →Treat any AI agent tool call combining an off-cluster --server URL with --insecure-skip-tls-verify=true as suspicious and require manual review before execution.
- →Do not let agents ingest untrusted, attacker-writable content (like pod logs) as part of their instruction context without sanitization.
Known benign look-alikes
- A legitimate kubectl_generic call using --insecure-skip-tls-verify alone against a known internal dev cluster with self-signed certs (no --server flag present).
- A legitimate kubectl_generic call using --server= alone to target a documented endpoint, without disabling TLS verification.
- An operator intentionally connecting to a self-hosted cluster whose API server happens to use a self-signed cert and a non-default --server URL — expected to match; review confirms the destination is trusted, not attacker-controlled.
- Security advisory or PR text quoting the CVE-2026-47250 payload.