One Leading Dash Was Enough to Hand Over a Kubernetes Cluster

MCP Server Kubernetes had a critical flaw, and the trigger was a single dash. An attacker who could shape a tool argument could slip a leading dash into a parameter and point a kubectl call at their own API server. The command handed over the operator’s bearer token on the way out. VulnCheck scored it 9.3.

The bug is tracked as CVE-2026-61459. It affects mcp-server-kubernetes before version 3.9.0 and lives in the structured tools that wrap kubectl, the ones for get, describe, and delete. The project tried to block dangerous flags with a check named assertNoDangerousFlags. The check looked for known bad options. A parameter that started with a dash walked past it and injected a fresh one. The fix shipped in 3.9.0. The advisory landed in July 2026. The lesson did not expire with the patch.

The tool that runs kubectl is a credential

Model Context Protocol servers hand AI agents a toolbox. A Kubernetes server hands an agent the power to read, describe, and delete cluster resources. That is a lot of authority sitting behind a chat interface.

Most teams guard the cluster with role-based access control and service accounts. Fewer think of the agent’s toolbox as part of that same boundary. The server holds a token or a kubeconfig. Whatever the agent can be talked into, the server will execute. Here, one argument was enough to redirect kubectl and leak the credential whole.

Agents are getting this access faster than teams are writing policy for it. Platform groups are wiring MCP servers into internal tools now, and each server is a new door into production. The teams that hand out that access casually are rebuilding, in a new layer, the same over-permissioned service accounts they spent years trying to clean up.

Agent infrastructure inherits the oldest bugs

Argument injection is not new. It is one of the oldest bug classes in software, and it is boring to fix. What changed is who runs the command. An agent that calls kubectl on request turns a command-line flaw into a remote one, because the caller no longer needs a shell on the host. A model that follows a prompt reaches the same code path a human would.

That reframes agent security. The useful question is not whether the model can be tricked. It is what the agent’s tools can do once it is. A read-only server is a smaller blast radius than one with delete. A server scoped to a single namespace is smaller than cluster admin. The same reasoning that shrank human access for years applies to agents, and most teams have not applied it yet.

What to check before the next agent ships

Patch to 3.9.0 or later. Then treat every agent tool as a privileged interface. Grant the narrowest permissions that still do the job. Keep the token short lived. Log the commands the agent runs, not just the requests it makes. Assume the prompt will eventually be hostile, and design the tool layer so a bad prompt cannot become a root shell.

The next flaw will look different and land in a different project. The pattern will hold. Every protocol that lets an agent touch production will collect the same class of bug, and the fixes will stay mundane. The teams that stay ahead treat the toolbox as the perimeter.

None of this is exotic. It is the same discipline infrastructure teams already apply to service accounts and CI runners. The difference is that agent tooling arrived fast, shipped by small teams, and often wired into production before anyone wrote down what it could reach. That gap between adoption and control is what gave flaws like this one their reach.

Every announced commitment in this space is tracked with its source in our AI data centre power commitments record.

Related reading. K8sGPT Turns Cluster Error Messages Into Fixes a Human Can Use. AI Agents Breached 395 Organizations Through PaperCut, and the Patch Window Is Now Hours. OpenAI Just Made the Agent Harness a Managed Service. AI Infrastructure Runs on Four Layers. Most Break Below the Model..