CVE-2025-69902 - Vulnerability Analysis

Overview

kubectl-mcp-server v1.2.0 contains a command injection caused by improper sanitization in minimal_wrapper.py, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

Severity & Score

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version of kubectl-mcp-server.

References

• https://asec.ahnlab.com/ko/92922/
• https://github.com/rohitg00/kubectl-mcp-server
• https://github.com/rohitg00/kubectl-mcp-server/blob/main/kubectl_mcp_tool/minimal_wrapper.py
• https://pypi.org/project/kubectl-mcp-tool

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner