mcp-server-kubernetes Argument Injection Exposing Cluster Credentials (CVE-2026-61459)

DeviceProcessEvents
| where FileName in~ ("kubectl", "kubectl.exe")
| extend Args = tolower(ProcessCommandLine)
| where InitiatingProcessFileName has_any ("node", "node.exe", "npx", "python", "python3", "mcp-server-kubernetes")
    or InitiatingProcessCommandLine has "mcp-server-kubernetes"
| where Args has_any ("--kubeconfig", "--token", "--server=", "--as=", "--as-group", "--insecure-skip-tls-verify", "get secret", "exec", "run --", "--client-certificate", "--client-key")
    or Args matches regex @"\s-{1,2}\w+.*;\s*kubectl"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

index=* (sourcetype="linux:audit" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="linux_secure") process_name="kubectl*"
| eval args=lower(process)
| where (like(parent_process_name,"%node%") OR like(parent_process_name,"%npx%") OR like(parent_process_name,"%python%") OR like(parent_process,"%mcp-server-kubernetes%"))
| where match(args,"--kubeconfig|--token|--server=|--as=|--as-group|--insecure-skip-tls-verify|--client-certificate|--client-key|get\s+secret|exec\s|run\s--")
| table _time, host, user, parent_process_name, parent_process, process_name, process
| sort - _time

process where event.type == "start" and
  process.name in ("kubectl", "kubectl.exe") and
  process.parent.name in ("node", "npx", "python", "python3") and
  (
    process.command_line : "*--kubeconfig*" or
    process.command_line : "*--token*" or
    process.command_line : "*--server=*" or
    process.command_line : "*--as=*" or
    process.command_line : "*--insecure-skip-tls-verify*" or
    process.command_line : "*get secret*" or
    process.command_line : "*run --*" or
    process.command_line : "*--client-key*"
  )

SELECT QIDNAME(qid) AS event, "Process Name", "Parent Process Name", "Command Line", username, sourceip, starttime
FROM events
WHERE "Process Name" ILIKE '%kubectl%'
  AND ("Parent Process Name" ILIKE '%node%' OR "Parent Process Name" ILIKE '%npx%' OR "Parent Process Name" ILIKE '%python%' OR "Command Line" ILIKE '%mcp-server-kubernetes%')
  AND ("Command Line" ILIKE '%--kubeconfig%' OR "Command Line" ILIKE '%--token%' OR "Command Line" ILIKE '%--server=%' OR "Command Line" ILIKE '%--as=%' OR "Command Line" ILIKE '%--insecure-skip-tls-verify%' OR "Command Line" ILIKE '%get secret%' OR "Command Line" ILIKE '%--client-key%')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*os* ("kubectl")
| where process_name matches "kubectl*"
| where parent_process_name matches /node|npx|python/ or command_line matches /mcp-server-kubernetes/
| where command_line matches /--kubeconfig|--token|--server=|--as=|--insecure-skip-tls-verify|get secret|run --|--client-key/
| fields _messagetime, host, user, parent_process_name, process_name, command_line
| sort by _messagetime desc

rule mcp_server_kubernetes_arg_injection_cve_2026_61459 {
  meta:
    author = "Argus"
    description = "kubectl argument injection via mcp-server-kubernetes (CVE-2026-61459)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /kubectl/ nocase
    ($e.principal.process.file.full_path = /node|npx|python/ nocase or $e.target.process.command_line = /mcp-server-kubernetes/ nocase)
    $e.target.process.command_line = /--kubeconfig|--token|--server=|--as=|--insecure-skip-tls-verify|get\s+secret|run\s--|--client-key/ nocase
  condition:
    $e
}

#event_simpleName=ProcessRollup2 (FileName=/kubectl/i)
| ParentBaseFileName=/node|npx|python/i OR CommandLine=/mcp-server-kubernetes/i
| CommandLine=/--kubeconfig|--token|--server=|--as=|--insecure-skip-tls-verify|get\s+secret|run\s--|--client-key/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])