This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
ReleasePort's take
Moderate signalkubectl_create now limits filename/fromFile to stdio transport for remote deployments and introduces fromFileContent for client‑supplied content.
Why it matters: Security hardening restricts kubectl_create path‑resolving parameters to stdio, mitigating unsafe remote file access; adds fromFileContent enabling safe content population on any transport.
Summary
AI summarySecurity hardening restricts kubectl_create path‑resolving parameters to stdio and adds fromFileContent for remote deployments
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Restricts kubectl_create filename/fromFile parameters to stdio transport for remote deployments. Restricts kubectl_create filename/fromFile parameters to stdio transport for remote deployments. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Medium |
Adds fromFileContent parameter to populate ConfigMaps/Secrets from client-supplied content on any transport. Adds fromFileContent parameter to populate ConfigMaps/Secrets from client-supplied content on any transport. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
Full changelog
Security hardening for remote (SSE / Streamable HTTP) deployments: restrict the kubectl_create filename and fromFile parameters — which resolve paths on the machine running the server — to the stdio transport, and add a fromFileContent parameter to populate ConfigMaps/Secrets from client-supplied content on any transport (#332).
Security Fixes
- Restricted kubectl_create `filename` and `fromFile` parameters to stdio transport only, mitigating path resolution abuse in remote deployments
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]