CVE-2026-85201
Received Received - Intake

Memory Exhaustion in Eclipse Ankaios Agent

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Eclipse Foundation

Description
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-85201
EUVD
EUVD-2026-72341

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
eclipse ankaios From 0.1.0 (inc) to 1.0.1 (inc)
eclipse ankaios From 0.1.0 (inc) to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85201 is an unbounded memory allocation vulnerability in Eclipse Ankaios versions 0.1.0 through 1.0.1. The agent reads a workload-specified length from a protobuf message without validation, leading to excessive memory allocation that crashes the agent process. This disrupts orchestration services for all managed workloads.

Detection Guidance

Detecting this vulnerability requires checking if the Ankaios agent is running a vulnerable version (0.1.0 to 1.0.1) and if any workload has control interface access enabled. Monitor agent logs for crashes or memory allocation errors. Check the agent version with commands like 'ank-agent --version' or inspect running processes for the agent binary.

Impact Analysis

If exploited, this vulnerability causes the Ankaios agent to crash, halting lifecycle management, log streaming, and state updates for all workloads on the affected node. If auto-restart is enabled, repeated crashes could lead to a denial of service. Exploitation requires a workload with non-default control interface access.

Compliance Impact

This vulnerability could lead to denial of service for orchestration services, potentially causing loss of workload management and state propagation. For GDPR, this may impact availability of processing systems, while for HIPAA, it could disrupt healthcare workloads requiring continuous operation. Compliance may be affected if the vulnerability leads to unauthorized workload termination or data processing interruptions.

Mitigation Strategies

Immediately update the Ankaios agent to version 1.0.2 or later, which includes the fix for message size validation. If updating is not possible, restrict control interface access to untrusted workloads by removing or limiting 'controlInterfaceAccess.allowRules' in workload configurations. Monitor agent processes for crashes and restart them if they occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85201. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart