CVE-2025-66404
中文标题:
（暂无数据）
英文标题:
mcp-server-kubernetes potential security issue in exec_in_pod tool
漏洞描述
中文描述:
（暂无数据）
英文描述:
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Flux159 | mcp-server-kubernetes | < 2.9.8 | - | - |
cpe:2.3:a:flux159:mcp-server-kubernetes:<_2.9.8:*:*:*:*:*:*:*
|
| suyogs | mcp-server-kubernetes | * | - | - |
cpe:2.3:a:suyogs:mcp-server-kubernetes:*:*:*:*:*:node.js:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-66404 |
2025-12-05 02:05:30 | 2026-01-12 02:12:24 |
| NVD | nvd_CVE-2025-66404 |
2025-12-17 03:00:14 | 2026-01-12 02:28:04 |
版本与语言
安全公告
变更历史
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']