Flux159/mcp-server-kubernetes

AI review

This MCP server executes arbitrary kubectl and helm commands via child_process, which could allow an attacker to read, modify, or destroy Kubernetes resources. It also passes the entire process environment (including secrets like KUBECONFIG_YAML, K8S_TOKEN) to spawned commands, creating a risk of credential exfiltration if a command is compromised. The CI pipeline downloads and runs a remote shell script (get-helm-3) without verification, introducing a supply-chain risk.

• high Remote code execution in CI pipeline — In .github/workflows/ci.yml line 31, the command `curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash` downloads and executes a shell script from a remote URL without integrity checking. If the Helm repository or CDN is compromised, this could inject malicious code into the CI environment.
• high Full environment passed to subprocesses — Multiple files (e.g., exec_in_pod.ts, helm-operations.ts, kubectl-*.ts) pass `env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG }` to child processes. This exposes all environment variables, including sensitive credentials like K8S_TOKEN, KUBECONFIG_YAML, and KUBECONFIG_JSON, to any spawned kubectl or helm command. If a command is hijacked or misused, these secrets could be leaked.
• high Unrestricted kubectl flag injection — The environment variable `ALLOW_KUBECTL_UNSAFE_FLAGS` (src/security/kubectl-flags.ts:79) can enable arbitrary flags to be passed to kubectl. This could allow an attacker to bypass security controls, execute arbitrary code, or exfiltrate data via kubectl's `--exec` or `--as` flags.
• medium No input sanitization on kubectl/helm commands — The server constructs kubectl and helm commands from user-provided arguments (e.g., resource names, namespaces, flags) without sanitization. An attacker could inject additional commands or flags via crafted inputs, leading to arbitrary command execution on the host.
• low Telemetry configuration reads sensitive env vars — src/config/telemetry-config.ts reads `OTEL_TRACES_SAMPLER` from environment variables. While not directly dangerous, telemetry configuration could inadvertently expose operational details if misconfigured.

Model: deepseek-chat

Static findings