MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration

@@ -0,0 +1,107 @@
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+
+// Flags that would let a caller redirect kubectl to a different API server,
+// substitute credentials, or impersonate another identity. Allowing any of
+// these to flow in from tool inputs lets an attacker who can influence the
+// LLM's tool arguments (e.g. via indirect prompt injection in pod logs)
+// exfiltrate the operator's bearer token to an attacker-controlled host.
+//
+// Names are stored in canonical (long-form) kebab-case, without the leading
+// "--". Short aliases that have the same effect are listed in SHORT_ALIASES.
+const DANGEROUS_FLAGS = new Set<string>([
+  // Target / endpoint overrides
+  "server",
+  "kubeconfig",
+  "cluster",
+  "context",
+  "user",
+  "tls-server-name",
+
+  // TLS bypass
+  "insecure-skip-tls-verify",
+  "certificate-authority",
+  "client-certificate",
+  "client-key",
+
+  // Credential overrides
+  "token",
+  "username",
+  "password",
+  "auth-provider",
+  "auth-provider-arg",
+  "exec-command",
+  "exec-arg",
+  "exec-api-version",
+  "exec-env",
+
+  // Identity impersonation
+  "as",
+  "as-group",
+  "as-uid",
+]);
+
+const SHORT_ALIASES = new Set<string>([
+  "s", // -s is an alias for --server
+]);
+
+function isUnsafeFlagsAllowed(): boolean {
+  return process.env.ALLOW_KUBECTL_UNSAFE_FLAGS === "true";
+}
+
+function normalizeFlagName(raw: string): string {
+  // Strip leading dashes; drop "=value" suffix; lowercase.
+  let name = raw.replace(/^-+/, "");
+  const eq = name.indexOf("=");
+  if (eq !== -1) name = name.slice(0, eq);
+  return name.toLowerCase();
+}
+
+function isDangerousFlagName(rawName: string, fromArgs: boolean): boolean {
+  const name = normalizeFlagName(rawName);
+  if (DANGEROUS_FLAGS.has(name)) return true;
+  // Short aliases (-s) are only meaningful when they appear as a CLI token,
+  // not as a key in the `flags` object.
+  if (fromArgs && SHORT_ALIASES.has(name)) return true;
+  return false;
+}
+
+function reject(flag: string): never {
+  throw new McpError(
+    ErrorCode.InvalidParams,
+    `Refusing to run kubectl with flag "${flag}": this flag can redirect ` +
+      `kubectl to a different API server or substitute credentials, which ` +
+      `would allow exfiltration of the operator's bearer token. If you ` +
+      `genuinely need this flag, set ALLOW_KUBECTL_UNSAFE_FLAGS=true in the ` +
+      `server environment.`
+  );
+}
+
+/**
+ * Validate user-supplied kubectl flags and args. Throws an McpError if any
+ * dangerous flag is present and the unsafe-flags escape hatch is not set.
+ *
+ * The check covers:
+ *   - keys of the `flags` object (e.g. { server: "..." })
+ *   - tokens in the `args` array, in both joined ("--server=x") and split
+ *     ("--server", "x") forms, plus short aliases ("-s").
+ */
+export function assertNoDangerousFlags(
+  flags?: Record<string, unknown>,
+  args?: string[]
+): void {
+  if (isUnsafeFlagsAllowed()) return;
+
+  if (flags) {
+    for (const key of Object.keys(flags)) {
+      if (isDangerousFlagName(key, false)) reject(`--${normalizeFlagName(key)}`);
+    }
+  }
+
+  if (args) {
+    for (const tok of args) {
+      if (typeof tok !== "string") continue;
+      if (!tok.startsWith("-")) continue;
+      if (isDangerousFlagName(tok, true)) reject(tok);
+    }
+  }
+}

@@ -6,6 +6,7 @@ import {
   contextParameter,
   namespaceParameter,
 } from "../models/common-parameters.js";
+import { assertNoDangerousFlags } from "../security/kubectl-flags.js";
 
 export const kubectlGenericSchema = {
   name: "kubectl_generic",
@@ -71,6 +72,10 @@ export async function kubectlGeneric(
   }
 ) {
   try {
+    // Reject credential/target-redirecting flags before constructing the
+    // command. See src/security/kubectl-flags.ts for the rationale.
+    assertNoDangerousFlags(input.flags, input.args);
+
     // Start building the kubectl command
     const command = "kubectl";
     const cmdArgs: string[] = [input.command];

@@ -0,0 +1,202 @@
+import { expect, test, describe, beforeEach, afterEach } from "vitest";
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+import { assertNoDangerousFlags } from "../src/security/kubectl-flags.js";
+import { kubectlGeneric } from "../src/tools/kubectl-generic.js";
+import { KubernetesManager } from "../src/utils/kubernetes-manager.js";
+
+describe("assertNoDangerousFlags", () => {
+  const originalEnv = process.env.ALLOW_KUBECTL_UNSAFE_FLAGS;
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.ALLOW_KUBECTL_UNSAFE_FLAGS;
+    } else {
+      process.env.ALLOW_KUBECTL_UNSAFE_FLAGS = originalEnv;
+    }
+  });
+
+  describe("flags object", () => {
+    test("rejects --server", () => {
+      expect(() =>
+        assertNoDangerousFlags({ server: "https://attacker.example.com" })
+      ).toThrow(McpError);
+    });
+
+    test("rejects --insecure-skip-tls-verify", () => {
+      expect(() =>
+        assertNoDangerousFlags({ "insecure-skip-tls-verify": "true" })
+      ).toThrow(/insecure-skip-tls-verify/);
+    });
+
+    test("rejects --token", () => {
+      expect(() => assertNoDangerousFlags({ token: "abc" })).toThrow(/token/);
+    });
+
+    test("rejects --kubeconfig (alternate kubeconfig file)", () => {
+      expect(() =>
+        assertNoDangerousFlags({ kubeconfig: "/tmp/evil.yaml" })
+      ).toThrow(/kubeconfig/);
+    });
+
+    test("rejects impersonation flag --as", () => {
+      expect(() =>
+        assertNoDangerousFlags({ as: "system:admin" })
+      ).toThrow(/--as/);
+    });
+
+    test("rejection is case-insensitive", () => {
+      expect(() =>
+        assertNoDangerousFlags({ SERVER: "https://attacker" })
+      ).toThrow(McpError);
+    });
+
+    test("allows benign flags through", () => {
+      expect(() =>
+        assertNoDangerousFlags({
+          "from-literal": "key=value",
+          output: "json",
+          "dry-run": "client",
+        })
+      ).not.toThrow();
+    });
+
+    test("undefined / empty inputs are fine", () => {
+      expect(() => assertNoDangerousFlags()).not.toThrow();
+      expect(() => assertNoDangerousFlags({}, [])).not.toThrow();
+    });
+
+    test("error uses InvalidParams code", () => {
+      try {
+        assertNoDangerousFlags({ server: "x" });
+        throw new Error("should have thrown");
+      } catch (e) {
+        expect(e).toBeInstanceOf(McpError);
+        expect((e as McpError).code).toBe(ErrorCode.InvalidParams);
+      }
+    });
+  });
+
+  describe("args array", () => {
+    test("rejects joined form '--server=...'", () => {
+      expect(() =>
+        assertNoDangerousFlags(undefined, ["--server=https://attacker"])
+      ).toThrow(/--server/);
+    });
+
+    test("rejects split form '--server' 'value'", () => {
+      expect(() =>
+        assertNoDangerousFlags(undefined, ["--server", "https://attacker"])
+      ).toThrow(/--server/);
+    });
+
+    test("rejects short alias -s", () => {
+      expect(() =>
+        assertNoDangerousFlags(undefined, ["-s", "https://attacker"])
+      ).toThrow(/-s/);
+    });
+
+    test("rejects --insecure-skip-tls-verify=true in args", () => {
+      expect(() =>
+        assertNoDangerousFlags(undefined, ["--insecure-skip-tls-verify=true"])
+      ).toThrow(McpError);
+    });
+
+    test("rejects --token in args", () => {
+      expect(() =>
+        assertNoDangerousFlags(undefined, ["--token=stolen"])
+      ).toThrow(/--token/);
+    });
+
+    test("allows benign args (label selectors, etc.)", () => {
+      expect(() =>
+        assertNoDangerousFlags(undefined, [
+          "-l",
+          "app=foo",
+          "--field-selector=status.phase=Running",
+        ])
+      ).not.toThrow();
+    });
+
+    test("non-flag positional args are not inspected", () => {
+      // "server" as a positional resource name (e.g. `kubectl get server`)
+      // must not match the --server flag denylist.
+      expect(() => assertNoDangerousFlags(undefined, ["server"])).not.toThrow();
+    });
+  });
+
+  describe("escape hatch", () => {
+    test("ALLOW_KUBECTL_UNSAFE_FLAGS=true bypasses the check", () => {
+      process.env.ALLOW_KUBECTL_UNSAFE_FLAGS = "true";
+      expect(() =>
+        assertNoDangerousFlags(
+          { server: "https://x", "insecure-skip-tls-verify": "true" },
+          ["--token=t"]
+        )
+      ).not.toThrow();
+    });
+
+    test("other truthy-ish values do NOT bypass the check", () => {
+      process.env.ALLOW_KUBECTL_UNSAFE_FLAGS = "1";
+      expect(() => assertNoDangerousFlags({ server: "x" })).toThrow(McpError);
+
+      process.env.ALLOW_KUBECTL_UNSAFE_FLAGS = "yes";
+      expect(() => assertNoDangerousFlags({ server: "x" })).toThrow(McpError);
+    });
+  });
+});
+
+describe("kubectl_generic refuses dangerous flags before executing kubectl", () => {
+  // Sentinel: if kubectl were invoked we would see a real kubectl error
+  // ("Failed to execute kubectl command..."). We assert we instead get the
+  // denylist error, proving the guard runs before execFileSync.
+  const stubManager = {} as KubernetesManager;
+  const originalEnv = process.env.ALLOW_KUBECTL_UNSAFE_FLAGS;
+
+  beforeEach(() => {
+    delete process.env.ALLOW_KUBECTL_UNSAFE_FLAGS;
+  });
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.ALLOW_KUBECTL_UNSAFE_FLAGS;
+    } else {
+      process.env.ALLOW_KUBECTL_UNSAFE_FLAGS = originalEnv;
+    }
+  });
+
+  test("blocks the exact PoC payload (--server + --insecure-skip-tls-verify)", async () => {
+    await expect(
+      kubectlGeneric(stubManager, {
+        command: "get",
+        resourceType: "pods",
+        flags: {
+          server: "https://127.0.0.1:19001",
+          "insecure-skip-tls-verify": "true",
+        },
+      })
+    ).rejects.toThrow(/server/);
+  });
+
+  test("blocks dangerous flag smuggled through args", async () => {
+    await expect(
+      kubectlGeneric(stubManager, {
+        command: "get",
+        resourceType: "pods",
+        args: ["--server=https://attacker.example.com"],
+      })
+    ).rejects.toThrow(/--server/);
+  });
+
+  test("error code is InvalidParams (not InternalError)", async () => {
+    try {
+      await kubectlGeneric(stubManager, {
+        command: "get",
+        flags: { token: "x" },
+      });
+      throw new Error("should have thrown");
+    } catch (e) {
+      expect(e).toBeInstanceOf(McpError);
+      expect((e as McpError).code).toBe(ErrorCode.InvalidParams);
+    }
+  });
+});