CVE-2025-59377 is a low severity (CVSS 3.7) OS command injection in feiskyer mcp-kubernetes-server through version 0.1.11. It works even in read-only mode because the kubectl handler uses shell=True. The record lists no fixed version, so check the project for a newer release.
What's affected
The record says feiskyer mcp-kubernetes-server through 0.1.11 is affected, and points to the line in src/mcp_kubernetes_server/command.py where shell=True is used. No fixed version is given and I could not confirm one, so check the project's releases.
The record notes that this is unrelated to mcp-server-kubernetes and to CVE-2025-53355, which are different projects.
How to check if you're exposed
Find out whether the server is installed anywhere, including on developer laptops and agent hosts.
pip list 2>/dev/null | grep -i mcp-kubernetes
uv tool list 2>/dev/null | grep -i mcp-kubernetes
Then look at the configuration of your MCP clients for an entry that launches mcp-kubernetes-server, and note which kubeconfig and cluster context it uses. That context is what a command run through the server would act with.
What to do now
- Inventory where mcp-kubernetes-server runs and which kubeconfig it uses.
- Check the project for a release newer than 0.1.11 that addresses the shell call, and upgrade.
- Give the server a kubeconfig with the narrowest role you can, so a misused command cannot do much.
- Do not expose the MCP endpoint beyond the local machine or a trusted network.
- Treat read-only mode as a convenience setting here, not a security boundary, until a fix is confirmed.
Why it matters
The record maps this to CWE-78, OS command injection. The cause is passing an assembled command string to a shell. The notable point is that the project's read-only mode does not stop it, since the shell interprets the string before any kubectl level restriction applies.
The score is low, 3.7, because the vector says attack complexity is high and the impact is limited to low integrity. A low score is not the same as no risk, though, especially where the server holds credentials for a production cluster. It is not on the CISA KEV list. Tools that let an AI agent run cluster commands are a growing category, and each one should be reviewed for this pattern.
Command injection occurs when user input is passed to an operating system shell or command line without being neutralised. The shell then treats part of the input as instructions. The durable fix is to avoid the shell, call library functions directly where possible, and pass arguments as separate values rather than one assembled string.
For defenders, the practical signals are unexpected child processes spawned by a web server, and outbound connections from application servers that have no business making them. Both are worth alerting on for any internet facing application, whether or not this particular flaw applies to you.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Quick check
Does read-only mode protect against CVE-2025-59377?
No. The record says the injection works even in read-only mode.
Why is the severity only low?
The vector rates attack complexity as high and the impact as low integrity only. Your own exposure depends on what credentials the server holds.
Sources
- Source line cited in the record
- CVE request write up
- NVD record data
Last reviewed: 18 October 2026.
