flux159/mcp-server-kubernetes

v4.0.5 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 8d MCP Developer Tools

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

infrastructure kubernetes mcp server

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 8d

The release restricts server‑side path reads to stdio transport in kubectl_apply, kubectl_delete, and Helm chart tools.

Why it matters: Security: mitigates unintended file access across affected Kubernetes tooling with high severity (90).

AI summary

Server‑side path reads are restricted to the stdio transport in kubectl_apply, kubectl_delete, and Helm chart tools

Type	Severity	Summary	CVE
Security	Critical	Restricts server-side path reads to stdio transport in kubectl_apply, kubectl_delete, and Helm chart tools. Restricts server-side path reads to stdio transport in kubectl_apply, kubectl_delete, and Helm chart tools. Source: llm_adapter@2026-07-18 Confidence: high	—

Full changelog

Restrict server-side path reads (filename/valuesFile) to the stdio transport in kubectl_apply, kubectl_delete, and Helm chart tools (#346)

Server‑side path reads (filename/valuesFile) now limited to stdio transport in kubectl_apply, kubectl_delete, and Helm chart tools

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track flux159/mcp-server-kubernetes

Get notified when new releases ship.

About flux159/mcp-server-kubernetes

MCP Server for kubernetes management commands