Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
containers/kubernetes-mcp-server
main @ dff3055
25
Fixes
0
CVEs
HIGH
Peak severity
39.1%
Coverage
Highlights
Auth Bypass: 13 prior fixes. Scrutinize any change in this area.
pkg/http/authorization.go: most-fixed (5 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The project's authorization middleware has historically suffered from critical bypasses due to incorrect validation on hot-reload config changes, unverified offline JWT fallback, and failing to contextually validate tokens against multi-cluster targets. Developers must ensure runtime updates atomic state propagation and robust verification.
Auth Bypass: Bypasses in the Kubernetes client layer occurred when uninitialized REST mappers permitted unvalidated requests, and when raw prefix-matching rules failed to resolve resource types on path-based filters. Robust request interception via AccessControlRoundTripper is required.
Insecure Connection: Outbound token exchange and dynamic configurations failed to strictly enforce TLS constraints upon runtime config reloads, exposing raw Bearer tokens and credentials to local or MitM interception.