CVE-2026-46519: mcp-server-kubernetes Affected By Tool Access Control Bypass: Presentation-Layer Filtering Without Execution-Layer Enforcement

Synopsis

This is an access control bypass in mcp-server-kubernetes, a Model Context Protocol server used to manage Kubernetes clusters. The three environment variables documented as tool-access restrictions (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) are enforced only when a client lists available tools, not when a client actually calls a tool by name. A network-accessible attacker with any valid low-privilege account can invoke restricted Kubernetes operations directly, bypassing the intended restrictions entirely and gaining full read, write, and availability impact over cluster resources. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The MCP server is exposed over the network, so an attacker must be able to reach it remotely to issue tool-call requests.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker only needs credentials valid enough to interact with the MCP server, not administrative access.

• Victim interactionNot required

  No victim action is needed; the attacker calls restricted tools directly without any user involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free: knowing a restricted tool name is enough to invoke it, with no race conditions or special environmental setup required.

Blast Radius

• Reads any Kubernetes resource in the cluster, including secrets, config maps, and service account tokens.
• Writes or modifies Kubernetes resources, including deploying arbitrary workloads or altering existing deployments.
• Deletes cluster resources, disrupting running services and causing workload outages.