What happened
MKP, a Model Context Protocol server that lets AI agents interact with Kubernetes clusters, exposed a log-retrieval tool over its default HTTP transport without any authentication check, letting any network client read pod logs.
Why it matters
Pod logs frequently contain secrets, tokens, and sensitive application data; an unauthenticated MCP tool that can be used to exfiltrate them from a Kubernetes cluster is a serious data-exposure risk wherever this AI-agent-to-Kubernetes bridge is deployed.
Attack vector
MKP's default HTTP endpoint registers the unauthenticated get_resource MCP tool, which accepts attacker-controlled limitBytes and tailLines parameters for the pods logs subresource, allowing a remote unauthenticated client to pull arbitrary pod logs from the cluster.
Affected systems
MKP (StacklokLabs) < 0.4.1
Mitigation
Upgrade to MKP 0.4.1 or later and ensure MCP tool endpoints require authentication before network exposure.