PT-2026-41728 · Npm · Mcp-Server-Kubernetes

Published 2026-05-18 · Updated 2026-06-23 · CVE-2026-46519

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mcp-server-kubernetes (affected versions not specified)

Description An access control bypass exists where the read-only mode and other access control modes do not effectively restrict access. The software has over 20,000 weekly npm downloads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-46519

GHSA-CR22-WJX7-2W6M

OPENSUSE-SU-2026:10914-1

OPENSUSE-SU-2026:21152-1

Affected Products

Mcp-Server-Kubernetes

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46519.json · Exploit
• 🔥 https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-cr22-wjx7-2w6m · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:10914-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46519 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21152-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cr22-wjx7-2w6m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46519 · Vendor Advisory
• https://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.6.0 · Note
• https://github.com/Flux159/mcp-server-kubernetes · Note
• https://suse.com/security/cve/CVE-2026-46519 · Note
• https://twitter.com/PolicyLayer/status/2066516604926435487 · Twitter Post
• https://twitter.com/dailycve/status/2057610657726370140 · Twitter Post
• https://twitter.com/Ax_Sharma/status/2056369235434029101 · Twitter Post
• https://twitter.com/Manifold_ai_sec/status/2056770584797675786 · Twitter Post
• https://bugzilla.suse.com/1265880 · Note