CVE-2025-69902 - Vulnerability Analysis

Overview

kubectl-mcp-server v1.2.0 contains a command injection caused by improper sanitization in minimal_wrapper.py, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

Severity & Score

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version of kubectl-mcp-server.

References

• https://asec.ahnlab.com/ko/92922/
• https://github.com/rohitg00/kubectl-mcp-server
• https://github.com/rohitg00/kubectl-mcp-server/blob/main/kubectl_mcp_tool/minimal_wrapper.py
• https://pypi.org/project/kubectl-mcp-tool

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🔴 CVE-2025-69902 - Critical (9.8) A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69902/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner