CVE-2025-66404

Name: CVE-2025-66404
Creator: NVD / NIST
Published: 2025-12-03T21:15:53.233+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 1.29%

Last modified Jun 17, 2026

CVE-2025-66404 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. EPSS estimates a 1.29% chance of exploitation in the next 30 days.

Description

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.29%

66.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-77

Affected Software

Vendor	Product	Versions
Suyogs	Mcp-Server-Kubernetes	< 2.9.8

References

https://github.com/Flux159/mcp-server-kubernetes/commit/d091107ff92d9ffad1b3c295092f142d6578c48bPatch
https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-wvxp-jp4w-w8wgExploit, Vendor Advisory
https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-wvxp-jp4w-w8wgExploit, Vendor Advisory

Timeline

Published: Dec 3, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-66404?

How severe is CVE-2025-66404?

CVE-2025-66404 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.29% probability of exploitation in the next 30 days.

How do I fix CVE-2025-66404?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-66404?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST