title: mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)
id: ATR-2026-01927
rule_version: 1
status: experimental
description: |
  GitHub Security Advisory GHSA-gjv4-ghm7-q58q (CVE-2025-53355). The mcp-server-kubernetes package (<= 2.4.9) passes unsanitized tool parameters to execSync inside the kubectl_scale, kubectl_patch and explain_resource MCP tools. Shell metacharacters (; | && $() backticks) in those parameters allow arbitrary command execution on the host with the server's Kubernetes admin credentials. CWE-78, CVSS 7.5.
author: ATR Community (vulnerablemcp sync)
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
    - ASI05:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0051.001 - Indirect
  cve:
    - CVE-2025-53355
  cwe:
    - CWE-78
  external:
    - https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53355
compliance:
  owasp_agentic:
    - id: ASI02:2026
      context: OWASP Agentic ASI02:2026 is exercised by command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355); this rule provides runtime detection of that technique.
      strength: primary
    - id: ASI05:2026
      context: OWASP Agentic ASI05:2026 is exercised by command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355); this rule provides runtime detection of that technique.
      strength: secondary
  owasp_llm:
    - id: LLM06:2025
      context: OWASP LLM LLM06:2025 is exercised by command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355); this rule is a detection implementation for that category.
      strength: primary
    - id: LLM05:2025
      context: OWASP LLM LLM05:2025 is exercised by command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355); this rule is a detection implementation for that category.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: EU AI Act Article 15 (accuracy, robustness and cybersecurity) requires controls against command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355); this rule provides runtime detection evidence for that obligation.
      strength: primary
    - article: '9'
      context: EU AI Act Article 9 (risk management system) requires controls against command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355); this rule provides runtime detection evidence for that obligation.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: NIST AI RMF MG.2.3 (risk treatment options selected and tracked) is supported by this rule's detection of command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355).
      strength: primary
    - function: Measure
      subcategory: MS.2.7
      context: NIST AI RMF MS.2.7 (security and resilience evaluated and documented) is supported by this rule's detection of command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally-provided processes) is operationalised by this rule's detection of command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is operationalised by this rule's detection of command injection in mcp-server-kubernetes kubectl tool parameters (CVE-2025-53355).
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: mcp-command-injection
  scan_target: runtime
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives: []
  conditions:
    - field: content
      operator: regex
      value: (?i)\b(?:kubectl_scale|kubectl_patch|explain_resource)\b[^\n]{0,80}(?:;|\|\||&&|\||`|\$\()[^\n]{0,60}(?:curl|wget|nc|ncat|bash|sh|python3?|perl|ruby|node|powershell|cmd(?:\.exe)?|rm|cat|whoami|id|env|export|chmod|kubectl|cp|mv|eval|base64)\b
      description: An mcp-server-kubernetes kubectl tool name (kubectl_scale / kubectl_patch / explain_resource) followed on the same line by a shell separator or command substitution and a command/network binary -- the CVE-2025-53355 execSync injection shape.
    - field: content
      operator: regex
      value: (?i)"(?:name|resourceName|resourceType|replicas|patchData|patch)"\s*:\s*"[^"\n]{0,120}(?:;\s*|\|\|?\s*|&&\s*|`|\$\()[^"\n]{0,80}(?:curl|wget|nc|bash|sh|python3?|\brm\s|\bcat\s|whoami|id;|env;|chmod|base64|eval)
      description: JSON tool-call arguments for the kubectl MCP tools where a kubectl_scale/kubectl_patch/explain_resource parameter value embeds a shell separator or command substitution chained into a command/network binary.
    - field: content
      operator: regex
      value: (?i)\bexplain_resource\b[^\n]{0,40}(?:resourceType|name|arguments)\s*[:=]\s*["'][^"'\n]{0,80}(?:`[^`\n]{1,80}`|\$\([^)\n]{1,80}\))
      description: An explain_resource MCP tool invocation whose resourceType/name argument contains a backtick or $() command substitution passed straight into execSync.
response:
  actions:
    - alert
    - block_tool
  message_template: '[ATR-2026-01927] Command injection against mcp-server-kubernetes (CVE-2025-53355, CWE-78, CVSS 7.5): a kubectl_scale / kubectl_patch / explain_resource tool parameter carries shell metacharacters that reach execSync and execute with the cluster''s admin credentials. Blocking the tool invocation. Remediation: upgrade mcp-server-kubernetes to v2.5.0 or later (replaces execSync with execFileSync), and apply least-privilege Kubernetes service accounts.'
  notify:
    - security_team
confidence: 85
_llm_authored:
  model: claude (gstack subagent)
  generalization_note: 'The rule generalizes beyond the literal advisory PoC by anchoring on the three vulnerable mcp-server-kubernetes tool names (kubectl_scale, kubectl_patch, explain_resource) co-occurring on the same line with a shell separator or command substitution (; | || && backtick $()) that feeds a command/network binary -- the structural shape of CVE-2025-53355 execSync injection -- rather than any single attacker string. Three conditions cover the distinct surfaces: tool-name + metachar + command, JSON/kwargs argument values for those tools, and explain_resource backtick/$() substitution. Spans are bounded ({0,N}) to avoid greedy matching, and the tool names are required so it does not collide with generic shell-injection or stdio-config rules (ATR-2026-00521 / 00567 / 00543), nor fire on ordinary kubectl CLI usage.'
  note: Generation-time LLM authoring; verified by deterministic gate. Runtime detection is pure regex. Human review required before merge.