Medium severity · published Sep 7, 2026
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control…
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Eclipse Ankaios · Eclipse Foundation
0.1.0 through 1.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85201
github.com
https://github.com/eclipse-ankaios/ankaios/pull/791
github.com
https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.2
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/900
More from Eclipse Ankaios
8.4
CVE-2026-86836
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name…
8.3
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a…
4.8
CVE-2026-92611
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of…