CVE-2026-50125

Name of the Vulnerable Software and Affected Versions MKP (affected versions not specified)

Description The MKP server contains a memory exhaustion issue that allows an unauthenticated remote attacker to cause a denial of service. The get resource MCP tool proxies Kubernetes pod log requests but fails to validate the size of user-supplied parameters. Specifically, the limitBytes and tailLines variables are parsed as unbounded int64 values and forwarded to the Kubernetes API. The server then uses io.Copy to read the entire resulting log stream into an in-memory bytes.Buffer without an application-side size cap. This can lead to the process being terminated by the operating system due to out-of-memory (OOM) conditions. The issue is located in the buildPodLogOpts() and defaultGetPodLogs() functions within pkg/k8s/subresource.go.

Recommendations Implement a hard cap on the maximum allowed values for limitBytes and tailLines within the buildPodLogOpts() function to prevent unbounded requests. Use an io.LimitedReader when copying the log stream into the bytes.Buffer in the defaultGetPodLogs() function to ensure the memory usage does not exceed a predefined limit. Restrict access to the get resource tool or implement authentication to prevent unauthenticated remote access to the MCP server.