Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-18 | 1 | Disclosure1 |
| 2026-05-19 | 1 | Disclosure1 |
| 2026-05-21 | 1 | Disclosure1 |
| 2026-06-13 | 1 | General1 |
| 2026-06-15 | 1 | General1 |
The read-only mode in mcp-server-kubernetes (20,000+ weekly npm downloads) ...doesn't actually restrict anything. Neither do the other two access control modes. CVE-2026-46519, CVSS 8.8 🧵 https://t.co/M6ai5LRBJv
Post summary
The tweet indicates that access control modes in mcp-server-kubernetes do not enforce restrictions, referencing CVE‑2026‑46519 with a CVSS score of 8.8.
CVE-2026-46519 in mcp-server-kubernetes is worth understanding. CVSS 8.8. The access controls were real — they just didn't apply at the right layer.
Post summary
The tweet highlights CVE‑2026‑46519, noting its high CVSS score and the issue with access control application, but lacks specifics on PoC, exploit code, patch, or active exploitation.
CVE-2026-46519 (CVSS 8.8). Our research team found a high-severity access control bypass in mcp-server-kubernetes. 20K+ weekly npm downloads. 🧵 https://t.co/ADcCFw4JBu
Post summary
Researchers have disclosed CVE‑2026‑46519, a high‑severity access control bypass in mcp‑server‑kubernetes, rated CVSS 8.8, with no patch or exploit details provided.
CVE-2026-46519: Kubernetes MCP Security Flaw https://itknowledgebases.com/cve-2026-46519-kubernetes-mcp-security-flaw/
Post summary
The excerpt simply cites a blog post about CVE‑2026‑46519, a Kubernetes MCP security flaw, without providing deeper technical, exploit, or mitigation information.
🔴 mcp-server-#kubernetes, Tool Access Control Bypass, #CVE-2026-46519 (Critical) https://dailycve.com/mcp-server-kubernetes-tool-access-control-bypass-cve-2026-46519-critical/
Post summary
The text announces a new critical CVE‑2026‑46519 affecting mcp‑server for Kubernetes, describing it as a tool access control bypass.