{"action":"Upgrade mcp-server-kubernetes to 3.9.0 or later.","affected":[{"fixed":"3.9.0","introduced":"0"}],"component":"mcp-server-kubernetes","cve_ids":["CVE-2026-61459"],"ecosystem":"PyPI","epss":0.02362,"exploited":false,"fixed_versions":["3.9.0"],"ghsa_id":"GHSA-wmg3-h8mf-wgvr","id":"tcs_01M5KG2F7PC01PDAXQ7G890X8E","modified_at":"2026-08-19T12:55:51.779516464Z","published_at":"2026-07-10T21:32:32Z","references":["https://osv.dev/vulnerability/GHSA-wmg3-h8mf-wgvr","https://nvd.nist.gov/vuln/detail/CVE-2026-61459","https://github.com/Flux159/mcp-server-kubernetes/issues/328","https://github.com/Flux159/mcp-server-kubernetes/pull/329","https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a","https://github.com/Flux159/mcp-server-kubernetes","https://github.com/Flux159/mcp-server-kubernetes/releases/tag/3.9.0","https://www.vulncheck.com/advisories/mcp-server-kubernetes-argument-injection-via-kubectl-structured-tools"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-wmg3-h8mf-wgvr","url":"https://osv.dev/vulnerability/GHSA-wmg3-h8mf-wgvr"}],"summary":"mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials"}