Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

Fix availableCritical · CVSS 9.8EPSS 0.58%

Published May 12, 2026 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: kubectl-mcp-server 1.2.0, kubectl-mcp-server 1.2.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmkubectl-mcp-server456 downloads/week

Vulnerable versions
< 1.2.0
Fixed in
1.2.0

Check your project: npm ls kubectl-mcp-server --all

Is kubectl-mcp-server@1.2.0 safe to install? See the upgrade verdict →

PyPIkubectl-mcp-server719 downloads/week

Vulnerable versions
< 1.2.0
Fixed in
1.2.0

Check your project: pip show kubectl-mcp-server

Sources

CWE-94 Improper Control of Generation of Code ('Code Injection')

← All critical vulnerabilities