Is mcp-server-kubernetes safe?
5 fixed advisories Facts from the mcp-audit registry about the npm package mcp-server-kubernetes. The same data is served as JSON.
Check it from your terminal
mcp-audit vet mcp-server-kubernetesOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | flux159 |
|---|---|
| Verified publisher | no |
| Entry last checked | 2026-08-22 |
| Hash pins | none recorded |
| Provenance expected | no |
| Repository | https://github.com/Flux159/mcp-server-kubernetes |
Recorded advisories 5
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2025-53355 | not recorded | MCP Server Kubernetes vulnerable to command injection in several tools | 2.5.0 |
| CVE-2025-66404 | not recorded | mcp-server-kubernetes has potential security issue in exec_in_pod tool | 2.9.8 |
| CVE-2026-39884 | not recorded | MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting | 3.5.0 |
| CVE-2026-46519 | not recorded | MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement | 3.6.0 |
| CVE-2026-47250 | not recorded | MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration | 3.7.0 |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
No capability tags are recorded for this package yet.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit5 fixed CVEs
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/npm/mcp-server-kubernetes/)