CVE-2026-85201 describes a memory allocation vulnerability in Eclipse Ankaios versions 0.1.0 through 1.0.1. The agent fails to enforce limits on the length field in protobuf messages received via the Control Interface FIFO. A malicious or compromised workload with Control Interface access can specify an excessively large message length, triggering unbounded memory allocation. This can cause the Ankaios agent process to abort, resulting in loss of orchestration services for workloads managed by the agent. The vulnerability is classified under CWE-789 (Memory Allocation with Excessive Size) and CWE-1284. The CVSS 4.0 base score is 6.8 (medium severity), reflecting local attack vector with low complexity and high impact on availability. No official patch or remediation guidance is currently available.

Successful exploitation leads to unbounded memory allocation causing the Ankaios agent process to abort. This results in loss of orchestration services for workloads managed by the affected agent, potentially disrupting workload management and availability. The attack requires local privileges with Control Interface access but does not require user interaction or elevated privileges beyond that.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Control Interface access to trusted workloads only to reduce risk of exploitation. Monitor for abnormal agent crashes that may indicate exploitation attempts.