Vulnerability Overview

Disclosed in late June 2026, CVE-2026-46519 is a critical vulnerability in the mcp-server-kubernetes project, which implements the Model Context Protocol (MCP) to expose Kubernetes API operations as tools for AI agents.

The project allows administrators to enforce read-only or non-destructive policies on tools exposed to AI agents through environment variables (such as ALLOW_ONLY_READONLY_TOOLS or ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS). However, a critical disconnect in how these constraints are validated allows a client or a compromised/malicious AI agent to bypass these filters entirely and execute write operations (such as creating, modifying, or deleting resources) directly on the target Kubernetes cluster.

Technical Details

The Model Context Protocol operates in two main phases:

1. List Tools (tools/list): The server advertises available tools (their names, schemas, and descriptions) to the AI client.
2. Call Tool (tools/call): The AI client invokes a specific tool by name, passing the required arguments.

The vulnerability stems from the fact that mcp-server-kubernetes only enforced the restrictions configured by ALLOW_ONLY_READONLY_TOOLS and similar environment variables in the List Tools handler. When generating the list of available tools, the server filtered out write/destructive tools (e.g., delete_pod or create_deployment).

However, the Call Tool handler did not perform any validation checks against the environment variables. If an AI agent or an attacker directly sent a tools/call message specifying a restricted tool name (e.g., calling delete_namespace with parameters), the server executed the command directly, bypassing all read-only restrictions.

Architectural Bypass Diagram

Mitigation & Remediation

Organizations using AI agent pipelines connected to Kubernetes must patch their services immediately.

1. Upgrade mcp-server-kubernetes

Update the mcp-server-kubernetes package/container to version 3.6.0 or later. The patch implements the configuration restrictions directly in both the listing and execution paths, ensuring that unauthorized tool execution is rejected at the server level.

# Example upgrade for Node/NPM setups
npm install @modelcontextprotocol/server-kubernetes@latest

2. Apply Kubernetes RBAC (Defense in Depth)

MCP environment variables should not be the sole mechanism for restricting AI agent capabilities. You should always enforce the Principle of Least Privilege at the infrastructure layer:

• Associate the MCP server's Kubernetes ServiceAccount with a role that permits only the necessary actions.
• Do not grant mutating permissions (create, update, patch, delete) to the ServiceAccount if the agent only requires read access, regardless of the MCP server's configuration.

# Example of a Read-Only ClusterRole for the AI Agent ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mcp-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services", "deployments", "namespaces"]
  verbs: ["get", "list", "watch"]