Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-50125— MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion

Quick assessment

Affected
StacklokLabs mkp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MKP 是 Kubernetes 的模型上下文协议（Model Context Protocol, MCP）服务器。在 0.4.1 版本之前， 暴露了默认的 HTTP 端点，而 注册了一个未认证的 工具，该工具接受攻击者可控的 和 参数用于 Pod 日志子资源。 中的 将这些值解析为无界（unbounded）的 参数，而 则通过 将返回的 Kubernetes 日志流复制到内存中的 ，但缺乏应用层面的大小限制。 能够访问默认端口 8080 的 MCP 端点的远程攻击者，可以选择一个累积日志量较大的 Pod，并发送单

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
StacklokLabs mkp < 0.4.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50125

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGetPodLogs() copies the returned Kubernetes log stream through io.Copy into an in-memory bytes.Buffer without an application-side cap. A remote attacker who can reach the default port 8080 MCP endpoint and select a pod with sufficiently large accumulated logs can send one tools/call request that causes large allocations and additional response copies, while the request-frequency limiter does not constrain per-request volume. This can exhaust process memory, terminate the MKP server, and deny the MCP service; observed testing showed more than one GiB of RSS growth while handling a 128 MiB requested stream. This issue is fixed in version 0.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
StacklokLabs mkp < 0.4.1 -

II. Public POCs for CVE-2026-50125

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50125

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-50125 (1)

IV. Related Vulnerabilities

Same weakness: CWE-400

V. Comments for CVE-2026-50125

No comments yet

Leave a comment