Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

Fix availableCritical · CVSS 9.3EPSS 2.4%

Published Jul 10, 2026 · updated Oct 28, 2026

What to do

  1. Upgrade to a fixed version: mcp-server-kubernetes 3.9.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmmcp-server-kubernetes10,522 downloads/week

Vulnerable versions
< 3.9.0
Fixed in
3.9.0

Check your project: npm ls mcp-server-kubernetes --all

Is mcp-server-kubernetes@3.9.0 safe to install? See the upgrade verdict →

Sources

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

← All critical vulnerabilities