diff --git a/src/cloud_auth.ts b/src/cloud_auth.ts
index 097aeef4bf..bc175f1ade 100644
--- a/src/cloud_auth.ts
+++ b/src/cloud_auth.ts
@@ -63,6 +63,8 @@ export class CloudAuth implements Authenticator {
         if (!cmd) {
             throw new Error('Token is expired!');
         }
+        // Wrap cmd in quotes to make it cope with spaces in path
+        cmd = `"${cmd}"`;
         const args = config['cmd-args'];
         if (args) {
             cmd = cmd + ' ' + args;
diff --git a/src/config_test.ts b/src/config_test.ts
index 3a1a9419fc..bffe24eabd 100644
--- a/src/config_test.ts
+++ b/src/config_test.ts
@@ -4,9 +4,12 @@ import { dirname, join } from 'path';
 
 import { expect } from 'chai';
 import mockfs = require('mock-fs');
-import * as requestlib from 'request';
 import * as path from 'path';
+import * as requestlib from 'request';
 
+import * as filesystem from 'fs';
+import { fs } from 'mock-fs';
+import * as os from 'os';
 import { CoreV1Api } from './api';
 import { bufferFromFileOrString, findHomeDir, findObject, KubeConfig, makeAbsolutePath } from './config';
 import { Cluster, newClusters, newContexts, newUsers, User } from './config_types';
@@ -788,6 +791,31 @@ describe('KubeConfig', () => {
                 expect(opts.headers.Authorization).to.equal(`Bearer ${token}`);
             }
         });
+        it('should exec succesfully with spaces in cmd', async () => {
+            const config = new KubeConfig();
+            const token = 'token';
+            const responseStr = `{"token":{"accessToken":"${token}"}}`;
+            config.loadFromClusterAndUser(
+                { skipTLSVerify: false } as Cluster,
+                {
+                    authProvider: {
+                        name: 'azure', // applies to gcp too as they are both handled by CloudAuth class
+                        config: {
+                            'cmd-path': path.join(__dirname, '..', 'test', 'echo space.js'),
+                            'cmd-args': `'${responseStr}'`,
+                            'token-key': '{.token.accessToken}',
+                            'expiry-key': '{.token.token_expiry}',
+                        },
+                    },
+                } as User,
+            );
+            const opts = {} as requestlib.Options;
+            await config.applyToRequest(opts);
+            expect(opts.headers).to.not.be.undefined;
+            if (opts.headers) {
+                expect(opts.headers.Authorization).to.equal(`Bearer ${token}`);
+            }
+        });
         it('should exec with exec auth and env vars', async () => {
             const config = new KubeConfig();
             const token = 'token';
diff --git a/test/echo space.js b/test/echo space.js
new file mode 100755
index 0000000000..a36d8b7bdc
--- /dev/null
+++ b/test/echo space.js	
@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+
+// Just echo back all the args
+console.log(process.argv.slice(2).join(' '))
\ No newline at end of file